Splunk Search

Can't Extract Multiple Custom Fields

mxsullivan
New Member

Hello,

I'm trying to extract each of the 16 values following the "Latency:" string into 16 separate fields and then export the fields to a CSV file. The default extraction doesn't seem to extract them, so I used IFX to generate a Latency field, but that contained all 16 values in a single string, again, not what I need.

--

Jul 25 09:53:33 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942496)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox;type=d]

Jul 25 09:55:30 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942512)[10.1.131.205]: Latency: 0 16 0 68259 68259 0 0 68260 68260 68260 68260 68260 0 68260 0 16 [sftp://[::]:2060/dropbox/test1.dat]

Jul 25 09:56:39 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(944752)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox/;type=d]

--

I'm struggling with breaking out the 16 individual fields. Any suggestions would be greatly appreciated.

0 Karma

David
Splunk Employee
Splunk Employee

What I would probably do is, in a search string, add:

| rex field=_raw "Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)" | table Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9 Field10 Field11 Field12 Field13 Field14 Field15 Field16 

You can also put the first part in your props.conf, via:

[SourceType]
EXTRACT-SixteenFields = Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)

And then it will be automatically extracted for you.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...