Splunk Search

Automatic field extraction is failing for one field

omgwut56k
Path Finder

I have a field value named 'category' the raw values are for example.

"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"

When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.

Any ideas on what to look at?

Thank you

Tags (2)
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression

category="(?<category>[^"]*?)"

or for the second do something like

category=(?<category>.+?)\s+new_field

See here for the documentation on how to do those extractions.

omgwut56k
Path Finder

Perfect! Thank you.

0 Karma

gyslainlatsa
Motivator

hi,
please can you rephrase your question? because I do not compends you well

0 Karma

omgwut56k
Path Finder

I have edited the original question, let me know if that helps.
Thank you,

0 Karma

woodcock
Esteemed Legend

Show us your configuration files and your Knowledge Objects.

0 Karma

omgwut56k
Path Finder

Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.

props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...