Splunk Enterprise

Unstructured Data different fields from one event to another.

Engager

hi,
i am trying to figure out how to parse such a log file:

from server 1
NAME ; JAMES
PERFORMANCE ; 90/100
from server 1
NAME ; TONY
SUCCESS ; 60/80
from host 1
NAME ; ANNA
PERFORMANCE ; 70/100

as you can see, the name of the fields are changing and so are the values.
The event delimiter BREAK_ONLY_BEFORE is "from server".

tny idea how to parse this ?

thanks.

heloma.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this in your props.conf

REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Try this in your props.conf

REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Engager

no luck!
what I am looking for, is to auto-extract NAME, PERFORMANCE, SUCESS as new fields and 90/100 , etc as values.
any hint ?

thks

0 Karma

SplunkTrust
SplunkTrust

My apologies, the REGEX and FORMAT attributes should go in transforms.conf. Like this:

[semicolon]
REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2

Then put a reference to the transform in props.conf:

[MySourcetype]
TRANSFORMS-semicolon-separated = semicolon
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

Excellent! thanks.

0 Karma