Getting Data In

Parse A field that contains many Portential other fields

New Member

I am trying to parse a field that has much data and the fields will always be the same. Rex field will be too long to use it as often as I use it. The field names will be the names before the colon. For example ackn_time=1500394536, application=websphere Application Server

additional_info={ackn_time:1500394536,,receiving_time:1500394536,,message_number:54ad72a8-6bd4-71e7-01a0-0a8bc02b0000,notification_flag:0,u_message_source:WBSSPI_0005(7.401),trouble_tick_flag:0,u_message_notification_flag:0,msg_source_name:WBSSPI_0005(7.401),application:websphere Application Server,message_group:WBSSPI,u_message_group:WBSSPI,cma_value:WBSSPI-0005.2: Major threshold,u_cmdb_ci_appl:websphere Application Server,u_message_trouble_ticket_flag:0,}

Any help would be great!!

Tags (1)
0 Karma


I think what you'll want to do is create a transforms.conf for this sourcetype that creates the fields for you based on your regex. You will want to define what constitutes a field name (after a comma, before a colon) and what constitutes a field value (after the colon and before the comma). Then use FORMAT = $1::$2 to have Splunk figure out the field and values for you when you search.

See this thread for an example:

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...