Getting Data In

parse fields with multiple delimiters

utsavkb
New Member

I am using HUNK 6.1.1. I have the data in the below format in a csv file,

Description= Small Focus

EventID= 023

Index: 95

TimeStamp: 2013-07-03T04:14:38

AdditionalInfo= [FREE_TEXT] Last update : 11-07-13 00:02:49 Reset date : 10-05-09 00:31:26 exposure time : 30.316 s exposure counter : 1181.0

I have loaded the data from my HDFS location by creating a simple provider and index using csv loader, but i want to further parse the "AdditionInfo" field to extract the field-values (Last update,Reset date,exposure time & exposure counter) from it. The "AdditionalInfo" Column doesnt have a spefic delimiter.

How can I further parse the "AdditionalInfo" field so that I can use the field-values in it to generate some aggregates on these?

Tags (3)
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You should be able to use a few of the methods for extract fields at search time:

  1. Interactive field extractor
  2. Config files (props/transforms.conf)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...