Splunk Enterprise

Unstructured Data different fields from one event to another.

heloma
Engager

hi,
i am trying to figure out how to parse such a log file:

from server 1
NAME ; JAMES
PERFORMANCE ; 90/100
from server 1
NAME ; TONY
SUCCESS ; 60/80
from host 1
NAME ; ANNA
PERFORMANCE ; 70/100

as you can see, the name of the fields are changing and so are the values.
The event delimiter BREAK_ONLY_BEFORE is "from server".

tny idea how to parse this ?

thanks.

heloma.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this in your props.conf

REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this in your props.conf

REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2
---
If this reply helps you, Karma would be appreciated.

heloma
Engager

no luck!
what I am looking for, is to auto-extract NAME, PERFORMANCE, SUCESS as new fields and 90/100 , etc as values.
any hint ?

thks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My apologies, the REGEX and FORMAT attributes should go in transforms.conf. Like this:

[semicolon]
REGEX = ([^;]*) ; (.*)
FORMAT = $1::$2

Then put a reference to the transform in props.conf:

[MySourcetype]
TRANSFORMS-semicolon-separated = semicolon
---
If this reply helps you, Karma would be appreciated.
0 Karma

heloma
Engager

Excellent! thanks.

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...