Splunk Search

Field Extraction

Explorer

Hello, I am a n00bie in Splunk.
So I needed some information from unstructured .log file.
I added the data through the web interface, and then used field extraction to get some fields I wanted to get.
Now, I have UNSTRUC_LOG: EXTRACT- FIRST in Field extractions list.

UNSTRUCLOG: EXTRACT- FIRST Inline ^\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+:\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+/\w+\s+\w+-\w+\s+\w+-\w+\s+\w+\s+\w+\s+%\w+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<awaitsvctmsdb>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<awaitsvctmsdc>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<awaitsvctmsda>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<awaitsvctmsdd>\d+.\d+\s+\d+.\d+)\s+\d+.\d+\s+\w+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+\d+.\d+\s+(?P<awaitsvctm_sde>\d+.\d+\s+\d+.\d+)

How can I manipulate / edit the fields I extracted ?
Do I use |inputlookup?

I would appreciate any input from you guys.

Jack

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Is that by chance a table-shaped output from a unix shell command displaying info about disks?

If so, there are way more convenient ways of using the cells from such a table - do post a sample event and tell us more about the source.

Alternatively, grab the Linux App from https://splunkbase.splunk.com/app/273/ and see if it already contains pre-built configuration for that sourcetype.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Is that by chance a table-shaped output from a unix shell command displaying info about disks?

If so, there are way more convenient ways of using the cells from such a table - do post a sample event and tell us more about the source.

Alternatively, grab the Linux App from https://splunkbase.splunk.com/app/273/ and see if it already contains pre-built configuration for that sourcetype.

View solution in original post

0 Karma