Splunk Enterprise

transforms.conf - Parsing KVP pairs using DELIMS

jgreen1
Engager

This is a sample Oracle syslog below. Anybody know if it is possible to parse the string below following the LENGTH parameter using DELIMS? The object would be to avoid picking up each corresponding length of each value that is specified in the brackets following each key?

LENGTH: "353" SESSIONID:[7] "5544703" ENTRYID:[1] "1" ...

1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

If you want to do this as a search-time KV extraction, it would be very simple to use the following RegEx to separate your KV pairs:

PROPS.CONF:
[mysourcetype]
REPORT-mysourcetype = xf-kv

TRANSFORMS.CONF:
[xf-kv]
REGEX  = (?<_KEY_1>[^ ]+):(\[\d+\])?\s"(?<_VAL_1>[^ ]+)"

This will yield the following fields, based on your sample data, above:

LENGTH = 353
SESSIONID = 5544703
ENTRYID = 1

This removes the [count], the quotes, and enumerates the fields in a very simple way.

HTH
Ron

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

If you want to do this as a search-time KV extraction, it would be very simple to use the following RegEx to separate your KV pairs:

PROPS.CONF:
[mysourcetype]
REPORT-mysourcetype = xf-kv

TRANSFORMS.CONF:
[xf-kv]
REGEX  = (?<_KEY_1>[^ ]+):(\[\d+\])?\s"(?<_VAL_1>[^ ]+)"

This will yield the following fields, based on your sample data, above:

LENGTH = 353
SESSIONID = 5544703
ENTRYID = 1

This removes the [count], the quotes, and enumerates the fields in a very simple way.

HTH
Ron

Lamar
Splunk Employee
Splunk Employee

Perhaps you should anonymize that data before you index it.

http://www.splunk.com/base/Documentation/4.1.6/Admin/Anonymizedatawithsed

If that data doesn't matter to you it might behoove you to not index, just sayin...

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...