Knowledge Management

I need to extract a field

Isa
New Member

Buenos días chicos.

Soy nuevo en splunk cuando se trata de extraer datos, así que necesito su apoyo.

Actualmente estoy inyectando los datos en splunk en formato Json y necesito extraer el siguiente campo.

 

Isa_1-1601327576925.png

Debe tenerse en cuenta que: 1. La ip remota cambia por lo que no es posible simplemente extraer la ip. 2. en allHeaderValue, los ocultos al mostrarlos se denominan nombre y valor y todos traen datos diferentes. 3. Solo necesito extraer el campo x-repote-ip: 181.135.58.163 o x-repote-ip: (trae la ip que registras)

Sé que esto se hace con expresiones regulares pero tengo poco conocimiento sobre cómo hacerlo y afecta poco a Splunk porque entiendo que rex y regex generan un alto impacto en la herramienta

 

 

 

Labels (1)
0 Karma

Isa
New Member

Hello, how can I extract the data through regular expressions without using Extract new fields

0 Karma

efavreau
Motivator

Buenos días@Isa!

I'm thinking the best route here is to use the Field Extractor:
https://docs.splunk.com/Documentation/Splunk/Latest/Knowledge/ExtractfieldsinteractivelywithIFX

If that doesn't work for you, please let us know what you tried, what result you obtained, and why that wasn't what you needed.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

Isa
New Member

Hello, I understand that this has a high cost in the splunk resources, additionally I understand that there is another way to perform the data extraction, then we have another option?

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...