Splunk Search

Automatic field extraction is failing for one field

omgwut56k
Path Finder

I have a field value named 'category' the raw values are for example.

"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"

When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.

Any ideas on what to look at?

Thank you

Tags (2)
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

omgwut56k
Path Finder

Perfect! Thank you.

0 Karma

gyslainlatsa
Motivator

hi,
please can you rephrase your question? because I do not compends you well

0 Karma

omgwut56k
Path Finder

I have edited the original question, let me know if that helps.
Thank you,

0 Karma

woodcock
Esteemed Legend

Show us your configuration files and your Knowledge Objects.

0 Karma

omgwut56k
Path Finder

Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.

props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...