Splunk Search

Can you help me create the regex for an Index time field extraction?

MattibergB
Path Finder

Hi,

We are trying to create an index time field extraction. I tried following the docs, but I am making a mistake somewhere.

It is working as a search time extraction, but we are running into performance issues/would like to use tsats without a datamodel.

The log line is:

Feb 21 20:28:22 server-name %PARSER-5-TESTLOG_LOGGEDCMD: User:unknown user  logged command:!exec: enable

props:

[sourcetype]
TRANSFORMS-test = test

transforms:

[test]
REGEX = %(?\S+):\s(?[\S\s]+)
WRITE_META = true

Is anyone able to point me into the right direction?

Thanks in advance!

0 Karma
1 Solution

MuS
Legend

Hi MattibergB,

You don't necessarily need to have names for the capturing groups 😉

Try this in your transforms.conf

[test]
REGEX = %(\S+):\s([\S\s]+)
FORMAT = $1::$2
WRITE_META = true

Put it on the parsing instance and restart Splunk.

Hope this helps ...

cheers, MuS

PS: don't forget to add fields.conf on your SH like @somesoni2 mentioned

View solution in original post

0 Karma

MuS
Legend

Hi MattibergB,

You don't necessarily need to have names for the capturing groups 😉

Try this in your transforms.conf

[test]
REGEX = %(\S+):\s([\S\s]+)
FORMAT = $1::$2
WRITE_META = true

Put it on the parsing instance and restart Splunk.

Hope this helps ...

cheers, MuS

PS: don't forget to add fields.conf on your SH like @somesoni2 mentioned

0 Karma

MattibergB
Path Finder

Thank you for pointing me in the right direction!

Matti

0 Karma

somesoni2
Revered Legend

I hope you're following this documentation.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction#Define_ad...

So check these
1) ensure the regex is correct.
2) You need to have a name to the capturing group (name of the field). I don't see that in the config you posted in the question.
3) Add an entry in the fields.conf (see the documentation above).
4) Ensure that you're placing the config in correct Splunk server (heavy forwarder OR indexer whichever comes first on your data flow).

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...