Splunk Search

Creating new Field Extractions

Communicator

I have a set of log data in Splunk Search app contained in source=sampledata,sourcetype=sample.
field1,field2,field3 are new fields that i added through the recievers REST endpoint

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

Lets say if i want to extract the fields: field1, field2 & field3 at search time, so i configured the say i am going to create new field exractions in $Splunk_HOME/users/admin/search/local/props.conf (props config file for search app)

What is the regex expression to extract each of these fields at search time(extracting the key value pairs during search time)? I thought it would be something like [\^$.|?*+()].

0 Karma

Explorer

How to disable - extracting the fields based on key=value format in splunk, this is messing up my fields information, as i have defined columns in transform.conf file.

0 Karma

Contributor

By default, Splunk will automatically extract the fields based on key=value format. the left of equal sign as field name and the right as its value.

0 Karma

Legend

As a parameter in the API call. Specifically, the rf parameter. More info here: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearches#Tips_on_creating_searches

0 Karma

Communicator

As in the search commands?

0 Karma

Legend

You need to specify the fields you want to be returned in your search request. Do that, and the fields you want will show up.

0 Karma

Communicator

Yeah. When i want to retrieve the results from the search as an XML through search/jobs/{search_id}/results endpoint the i want the field xml tags to have the new field names i have created.
For example i want to see something like this when i retrieve.

Happy

0 Karma