Splunk Search

Can't Extract Multiple Custom Fields

New Member

Hello,

I'm trying to extract each of the 16 values following the "Latency:" string into 16 separate fields and then export the fields to a CSV file. The default extraction doesn't seem to extract them, so I used IFX to generate a Latency field, but that contained all 16 values in a single string, again, not what I need.

--

Jul 25 09:53:33 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942496)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox;type=d]

Jul 25 09:55:30 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942512)[10.1.131.205]: Latency: 0 16 0 68259 68259 0 0 68260 68260 68260 68260 68260 0 68260 0 16 [sftp://[::]:2060/dropbox/test1.dat]

Jul 25 09:56:39 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(944752)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox/;type=d]

--

I'm struggling with breaking out the 16 individual fields. Any suggestions would be greatly appreciated.

0 Karma

Splunk Employee
Splunk Employee

What I would probably do is, in a search string, add:

| rex field=_raw "Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)" | table Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9 Field10 Field11 Field12 Field13 Field14 Field15 Field16 

You can also put the first part in your props.conf, via:

[SourceType]
EXTRACT-SixteenFields = Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)

And then it will be automatically extracted for you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!