Splunk Search

Help with transforms

ericrobinson
Path Finder

Hello, I have been using splunk for about 6 months and continue to be amazed at what the product can do..

Anyway, I need some help with writing a Transform. I have been using field extractions for a while, but as I suspected, there appears to be a better way.

Here is the scenario, I have several stats that I need to pull out of the log.

An example:

2010-08-23 13:27:40,593 [xxxx]: INFO  StatEntry - line: 192 - [STAT] { receive-xxxx 323.0 { on queue 000.0 } { run 323.0 { ERPOC-updateFIXMessageAsProcessed() 323.0 { ERPOC-fetchFIXMessage() 003.0 } { ERPOC-updateFIXMessage() 103.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 106.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 105.0 } } } }

Is there a way for me to write one Transform via the manager to get all of these fields and their respective values?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not via the Manager UI, but certainly via the config files:

props.conf:

[mysourcetype]
REPORT-extractmystats = extractmystats

transforms.conf

[extractmystats]
REGEX = \{\s*([\w-]+)(?:\(\))?\s+([\w\.-]+)
FORMAT = $1::$2
MV_ADD = true

seems will probably do close to whatever you want, although you don't explicitly say what exactly you are trying to pull out and how, or what you want to do with the data. Note that it will create some fields in a single event as multivalued fields.

ericrobinson
Path Finder

Thank you for your comment.. I was actually able to succedd using the manager. My regex was good.. I just nelgected to create an associated field extraction using the new transform. I had thought the transform was enough. As soon as I added a field extraction calling out the transform, I can see the values.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...