Splunk Search

Dynamic field name extration

ninisimonishvil
Path Finder

Here is the data :

"app": "https", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "https", "purpose": "inspect", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "inspect", "direction": "outbound", "int64gapps": "0"

And here is regex: \"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)"

I have 3 groups and as a Format I want it to use Group 1 and 2 as a Field name and group 3 as a value. so my FORMAT= $1.$2::$3

TRANSFORMS.conf
[Bandtest]
REGEX=(\"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)")
FORMAT=$1.$2::$3
WRITE_META = True

PROPS.cong
[radware_api_stat]
TRANSFORMS-Bandtest = Bandtest

I need SPlunk to extract field names httpbypass and httpinspect, it only extracts the first one. in short I need it to get multiple field names per event using the same regex, is this function available?

Tags (1)
0 Karma

FrankVl
Ultra Champion

Is it just me, or are you processing multiple events as 1 and using field values as field names?

Does this have to be extracted at index time?

Perhaps simpler to just extract the actual fields and their values and then create some calculated fields off of those to club things together as you are describing here? But still a bit confused about the context to be honest...

0 Karma

ninisimonishvil
Path Finder

now I have changed it to REPORT but another issue
I have two groups and in Format I want to concatenate values FORMAT=handrej_Client_outbound::$1.$2 where first grouping is a sentence and second number.

is there any special syntax for that?

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...