Splunk Search

Header extraction rename

ShaneNewman
Motivator

I am monitoring several BizTalk\MSMQ perfmon counters (Host Counters, General Counters, MSMQ Queue, MSMQ Service). I have setup field extraction based on the header row of this file, and it is garbage! For the General Counters, I was able to setup a transform in the props.conf to rip out the header and setup field extraction via KV because the column names never change. For the other 3, that is not the case.

Is there a way to setup some sort of regular expression to dynamically extract field names based on the header row?

Example:

"\\hostname\BizTalk:Message Box:Host Counters(HOST_COUNTER_NAME:biztalkmsgboxdb:HOSTNAME.test.test.net,56219)\Host Queue - Number of INSTANCES"

Becomes -> host_counter_name_instances

I have CAPITALIZED the location of the identifiers I need in the default header.

0 Karma
1 Solution

ShaneNewman
Motivator

I turned on the counters in WMI, then used the wql tool in Splunk to capture the data. Not idea but it did the job perfectly.

View solution in original post

ShaneNewman
Motivator

I turned on the counters in WMI, then used the wql tool in Splunk to capture the data. Not idea but it did the job perfectly.

ShaneNewman
Motivator

I know the regex to do the field extractions to create the name I want it to be.

I cannot find it documented anywhere if there is a way to dynamically create field names from the header row without indexing it - other than just using what the header row has in it to begin with...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...