Splunk Search

Extracting fields for a report with regex not working

henrikb
New Member

Hi

I'm trying to "extract fields" with regular expressions for a specific position on a comma separated log file that always has the same number of fields on each row.

The file looks like this (one row):

2010-09-15 15:38:55 ,Default_TCr10.20_Webb.war,,ODRTEST01,HTTP,37,1,0,37,37,1,2010-09-15 15:33:50 ,2010-09-15 15:38:50 ,0,4.969857,0,0,0,2010-09-15 15:33:50,0

It's separated in 20 fields.

Lets say that I want the field at position 15 i.e. 4.969857 The problem for me how to solve this is that the fields after and before can be '', '0' or 'a date-time' and I can't get | (pipe) and parenthesis to work.

Is it possible solve in Splunk?

I'm using version 4.1.3.

Tags (1)
0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

If your events always have those 20 fields separated by commas, you should use a delimiter-based field extraction, as described here in the Knowledge Manual :

http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

In your case, the following steps should work.

1 - Define the delimiter-based field extraction in $SPLUNK_HOME/etc/system/local/transforms.conf

[delimiter_based_extraction] 
DELIMS = "," 
FIELDS = field1, field2, field3, field4, field5, field6, field7, field8, field9, field10, field11, field12, field13, field14, field15, field16, field17, field18, field19, field20

2 - Call that extraction for the desired spec (source, sourcetype or host) in $SPLUNK_HOME/etc/system/local/props.conf

[my_sourcetype]
REPORT-delims = delimiter_based_extraction

The fields defined for extraction should now appear in the field picker.

View solution in original post

hexx
Splunk Employee
Splunk Employee

If your events always have those 20 fields separated by commas, you should use a delimiter-based field extraction, as described here in the Knowledge Manual :

http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

In your case, the following steps should work.

1 - Define the delimiter-based field extraction in $SPLUNK_HOME/etc/system/local/transforms.conf

[delimiter_based_extraction] 
DELIMS = "," 
FIELDS = field1, field2, field3, field4, field5, field6, field7, field8, field9, field10, field11, field12, field13, field14, field15, field16, field17, field18, field19, field20

2 - Call that extraction for the desired spec (source, sourcetype or host) in $SPLUNK_HOME/etc/system/local/props.conf

[my_sourcetype]
REPORT-delims = delimiter_based_extraction

The fields defined for extraction should now appear in the field picker.

henrikb
New Member

Thanks, this will work for me.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...