How do I edit my transforms.conf to properly extract these fields from my sample data?

[akanno]

Hi All.

I want to extract fields from the following log data.

headerName=Host, Connection, Accept, headerValue=splunk.com, keep-alive, text/html

I want to extract fields like this.

Host=splunk.com
Connection=keep-alive
Accept=text/html

So I set following in props and transforms

props.conf

[MY_SYSLOG]
REPORT-a = SAMPLE_1,SAMPLE_2,SAMPLE_3

transforms.conf

[SAMPLE_1]
CLEAN_KEYS = 0
FORMAT = $1::$4
REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*)

[SAMPLE_2]
CLEAN_KEYS = 0
FORMAT = $2::$5
REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*)

[SAMPLE_3]
CLEAN_KEYS = 0
FORMAT = $3::$6
REGEX = headerName=(\w+),\s(\w+),\s(\w+),\sheaderValue=(.*?),\s(.*?),\s(.*)

This setting extracted fields for part log message, but didn't extract fields for the following log message.

headerName=Host, Connection, Accept, Referer, headerValue=splunk.com, keep-alive, text/html, http://google.com

Is there good solution?

Thank you for your help.

[maciep]

In the example that didn't work, do you want to extract Referer too? Or do you only care about host, connection and accept? Are the values always in the same order after the headerValue= part of the event? Not sure if just hardcoding fieldname is an option or makes sense.

In general though, there are probably a few ways to make this work for you. It's just a regex thing. For example, something like this might work in props.conf

[MY_SYSLOG]
EXTRACT-myfields = headerName=Host,\s+?Connection,\s+?Accept,.+headerValue=(?<host>[^,]+),\s+?(?<connection>[^,]+),\s+?(?<Accept>[^,]+)