Getting Data In

Translation from rex to IFX or props.conf

royimad
Builder

I have the following query and i would like to preserve the extraction and not calling this extraction each time on a search

... | rex field=TotalCabinets "(?<DescriptionTotal>.*):(?<TotalCabinetsNbr>.*)" | table ...

How do i preserve "save" this extraction without calling it each time on my query, what is the translation of this query on Interactive field extraction or on props.conf?

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Assuming you have single-line events;
props.conf

[your_sourcetype]
EXTRACT-blah = (?m)Total\sCabinets:(?<TotalCabinetsNbr>\d+)

ought to work. If it doesn't, please post some sample events.

Note: Edited for multiline logs and the extra space.

/K

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

In my example below you see that the field is extracted straight from the event text. Not based off an extracted field.

kristian_kolb
Ultra Champion

Assuming you have single-line events;
props.conf

[your_sourcetype]
EXTRACT-blah = (?m)Total\sCabinets:(?<TotalCabinetsNbr>\d+)

ought to work. If it doesn't, please post some sample events.

Note: Edited for multiline logs and the extra space.

/K

0 Karma

kristian_kolb
Ultra Champion

Apart from the edited regex above, you could also try (if TotalCabinets is already extracted).

EXTRACT-blah = some_regex in source_field

Haven't really played with that, but I assume that all 'in source_field' extractions take place after those that work on _raw. See the EXTRACT section of the props.conf docs.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Admin/Propsconf

0 Karma

royimad
Builder

Here is an example event:
Date = "20-Aug-2013 08:32:10 -0400"
From = "Roy Imad roy.imad@company.com"
To = "Roy Imad roy.imad@company.com"
Subject = "FW: [POSMonitor R1.5.1.0] DCPMonitor Inspection Summary"
mailbox = "splunk"
size = 12691
____________________ Message Body ____________________

DCPMonitor REPORT - Tue, Aug 20, 2013 at 00:00

Total Cabinets: 152, Offline Cabinets: 6
XPOS10027 - St ZZZZZZ Hospital of XXXXX - Cath Lab - Cath Room

0 Karma

royimad
Builder

There are space between Total and Cabinets ,
can i use EXTRACT-blah = "Total Cabinets:"(?<TotalCabinetsNbr>\d+) ?

0 Karma

cpeteman
Contributor

I'm not sure if you can extract information from another field if you extract that first field in the same props.conf file. Is that the case here?

royimad
Builder

I need 293 the value wich is TotalCabinetNbr

0 Karma

royimad
Builder

TotalCabinets is already extracted and exist, I need to extract TotalCabinetNbr

TotalCabinets is like "Total Cabinets:293" and i need

0 Karma

cpeteman
Contributor

Whcih is the field you want TotalCabinets or TotalCabinetsNbr?

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...