Splunk Search

Dynamic field name extration

ninisimonishvil
Path Finder

Here is the data :

"app": "https", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "https", "purpose": "inspect", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "inspect", "direction": "outbound", "int64gapps": "0"

And here is regex: \"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)"

I have 3 groups and as a Format I want it to use Group 1 and 2 as a Field name and group 3 as a value. so my FORMAT= $1.$2::$3

TRANSFORMS.conf
[Bandtest]
REGEX=(\"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)")
FORMAT=$1.$2::$3
WRITE_META = True

PROPS.cong
[radware_api_stat]
TRANSFORMS-Bandtest = Bandtest

I need SPlunk to extract field names httpbypass and httpinspect, it only extracts the first one. in short I need it to get multiple field names per event using the same regex, is this function available?

Tags (1)
0 Karma

FrankVl
Ultra Champion

Is it just me, or are you processing multiple events as 1 and using field values as field names?

Does this have to be extracted at index time?

Perhaps simpler to just extract the actual fields and their values and then create some calculated fields off of those to club things together as you are describing here? But still a bit confused about the context to be honest...

0 Karma

ninisimonishvil
Path Finder

now I have changed it to REPORT but another issue
I have two groups and in Format I want to concatenate values FORMAT=handrej_Client_outbound::$1.$2 where first grouping is a sentence and second number.

is there any special syntax for that?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...