Extracting Fields after Custom Processing Command

[MatthewTowey]

Hi

I am processing log files by running custom command which transforms the data that I have looked for e.g

(8=FIX.4.4|9=123|35=D|56=BLPUS|49=FMRFIBOOM|52=20120502-12:14:31|34=15|54=8|55=IBM|38=15200|44=27|11=Order8|21=2|60=20120502-12:14:31|40=7|10=118|)

becomes

(BeginString=FIX.4.4|BodyLength=123|MsgType=New Order - Single|TargetCompID=BLPUS|SenderCompID=FMRFIBOOM|SendingTime=20120502-12:14:31|MsgSeqNum=15|Side=Cross|Symbol=IBM|OrderQty=15200|Price=27|ClOrdID=Order8|HandlInst=Automated execution order,public,Broker intervention OK|TransactTime=20120502-12:14:31|OrdType=Limit or better|CheckSum=118|)

The fields (8=,9=,35=) are been extracted correctly and appearing under "Other Interesting Fields" but the new post processing fields (BeginString=,BodyLength=,MsgType=) are not been extracted to the "Other Interesting Fields" section.

Does anyone know how to configure Splunk to do this automatically when a search is run?

Thanks in advance
Matt

[kristian_kolb · Accepted solution]

Did you give up on the CLEAN_KEYS? I thought you got that working.

If your keys are all numeric when you let splunk index the files (as I assume they are) you can add nice names through FIELDALIAS;

http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addaliasestofields

In props.conf

[your sourcetype]
FIELDALIAS-blah 8 AS BeginString 9 AS BodyLength

etc etc

Hope this helps,

Kristian

[MatthewTowey]

Hello again Kristian
Yes using Field Alias has worked.
Thanks for the suggestion
Mat