Splunk Search

Creating new Field Extractions

misteryuku
Communicator

I have a set of log data in Splunk Search app contained in source=sampledata,sourcetype=sample.
field1,field2,field3 are new fields that i added through the recievers REST endpoint

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

Lets say if i want to extract the fields: field1, field2 & field3 at search time, so i configured the say i am going to create new field exractions in $Splunk_HOME/users/admin/search/local/props.conf (props config file for search app)

What is the regex expression to extract each of these fields at search time(extracting the key value pairs during search time)? I thought it would be something like [\^$.|?*+()].

0 Karma

deepakmurthy
Explorer

How to disable - extracting the fields based on key=value format in splunk, this is messing up my fields information, as i have defined columns in transform.conf file.

0 Karma

hjwang
Contributor

By default, Splunk will automatically extract the fields based on key=value format. the left of equal sign as field name and the right as its value.

0 Karma

Ayn
Legend

As a parameter in the API call. Specifically, the rf parameter. More info here: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearches#Tips_on_creating_searches

0 Karma

misteryuku
Communicator

As in the search commands?

0 Karma

Ayn
Legend

You need to specify the fields you want to be returned in your search request. Do that, and the fields you want will show up.

0 Karma

misteryuku
Communicator

Yeah. When i want to retrieve the results from the search as an XML through search/jobs/{search_id}/results endpoint the i want the field xml tags to have the new field names i have created.
For example i want to see something like this when i retrieve.

Happy

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...