Splunk Search

Automatic field extraction is failing for one field

omgwut56k
Path Finder

I have a field value named 'category' the raw values are for example.

"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"

When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.

Any ideas on what to look at?

Thank you

Tags (2)
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

omgwut56k
Path Finder

Perfect! Thank you.

0 Karma

gyslainlatsa
Motivator

hi,
please can you rephrase your question? because I do not compends you well

0 Karma

omgwut56k
Path Finder

I have edited the original question, let me know if that helps.
Thank you,

0 Karma

woodcock
Esteemed Legend

Show us your configuration files and your Knowledge Objects.

0 Karma

omgwut56k
Path Finder

Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.

props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...