Splunk Search

Extracting "bean string" formatted logs

New Member

I have some log entries that look like the following:

 foo2011-06-25T20:12:54 [a.b.c.d] Promoting SystemFingerprint [[architecture=null][certainty=0.8][description=Sun Solaris][deviceClass=null][family=Solaris][product=Solaris][vendor=Sun][version=null]] source: NTP

In some (all?) cases, when the default extractions happen, fields that have whitespace don't appear to be extracting correctly. For example, I would like 'description' from the above example to be 'Sun Solaris', however it is 'Sun'. I have tried the following with extract:

extract pairdelim="\]\[", kvdelim="=" auto=f

One workaround I have used is to use rex to pull out all of the fields, however the format for these logs isn't always the same (there may be more key value pairs, sometimes in a different order).

Any ideas?

Tags (3)
0 Karma
1 Solution

Influencer

The following should work:

props.conf

[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none

transforms.conf

[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true

View solution in original post

Influencer

The following should work:

props.conf

[your_sourcetype]
REPORT-bean-kv = extract-bean-kv
KV_MODE = none

transforms.conf

[extract-bean-kv]
REGEX = \[([^=\]]+)=([^=\]]+)\]
FORMAT = $1::$2
CLEAN_KEYS = true

View solution in original post

New Member

Perfect. Thank you.

0 Karma