Help with transforms

[ericrobinson]

Hello, I have been using splunk for about 6 months and continue to be amazed at what the product can do..

Anyway, I need some help with writing a Transform. I have been using field extractions for a while, but as I suspected, there appears to be a better way.

Here is the scenario, I have several stats that I need to pull out of the log.

An example:

2010-08-23 13:27:40,593 [xxxx]: INFO  StatEntry - line: 192 - [STAT] { receive-xxxx 323.0 { on queue 000.0 } { run 323.0 { ERPOC-updateFIXMessageAsProcessed() 323.0 { ERPOC-fetchFIXMessage() 003.0 } { ERPOC-updateFIXMessage() 103.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 106.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 105.0 } } } }

Is there a way for me to write one Transform via the manager to get all of these fields and their respective values?

[gkanapathy]

Not via the Manager UI, but certainly via the config files:

props.conf:

[mysourcetype]
REPORT-extractmystats = extractmystats

transforms.conf

[extractmystats]
REGEX = \{\s*([\w-]+)(?:\(\))?\s+([\w\.-]+)
FORMAT = $1::$2
MV_ADD = true

seems will probably do close to whatever you want, although you don't explicitly say what exactly you are trying to pull out and how, or what you want to do with the data. Note that it will create some fields in a single event as multivalued fields.

[ericrobinson]

Thank you for your comment.. I was actually able to succedd using the manager. My regex was good.. I just nelgected to create an associated field extraction using the new transform. I had thought the transform was enough. As soon as I added a field extraction calling out the transform, I can see the values.