Splunk Search

Can you help me create the regex for an Index time field extraction?

MattibergB
Path Finder

Hi,

We are trying to create an index time field extraction. I tried following the docs, but I am making a mistake somewhere.

It is working as a search time extraction, but we are running into performance issues/would like to use tsats without a datamodel.

The log line is:

Feb 21 20:28:22 server-name %PARSER-5-TESTLOG_LOGGEDCMD: User:unknown user  logged command:!exec: enable

props:

[sourcetype]
TRANSFORMS-test = test

transforms:

[test]
REGEX = %(?\S+):\s(?[\S\s]+)
WRITE_META = true

Is anyone able to point me into the right direction?

Thanks in advance!

0 Karma
1 Solution

MuS
Legend

Hi MattibergB,

You don't necessarily need to have names for the capturing groups 😉

Try this in your transforms.conf

[test]
REGEX = %(\S+):\s([\S\s]+)
FORMAT = $1::$2
WRITE_META = true

Put it on the parsing instance and restart Splunk.

Hope this helps ...

cheers, MuS

PS: don't forget to add fields.conf on your SH like @somesoni2 mentioned

View solution in original post

0 Karma

MuS
Legend

Hi MattibergB,

You don't necessarily need to have names for the capturing groups 😉

Try this in your transforms.conf

[test]
REGEX = %(\S+):\s([\S\s]+)
FORMAT = $1::$2
WRITE_META = true

Put it on the parsing instance and restart Splunk.

Hope this helps ...

cheers, MuS

PS: don't forget to add fields.conf on your SH like @somesoni2 mentioned

0 Karma

MattibergB
Path Finder

Thank you for pointing me in the right direction!

Matti

0 Karma

somesoni2
Revered Legend

I hope you're following this documentation.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction#Define_ad...

So check these
1) ensure the regex is correct.
2) You need to have a name to the capturing group (name of the field). I don't see that in the config you posted in the question.
3) Add an entry in the fields.conf (see the documentation above).
4) Ensure that you're placing the config in correct Splunk server (heavy forwarder OR indexer whichever comes first on your data flow).

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...