Splunk Search

How do I extract a semicolon separated field during search?

Oti47
Path Finder

Hi I have a Log string event like this, between a different defined log format.
How could is separate the fields during the search time?

It is possible, to add the additional field definition into my standard definition at the property files?

Thanks.

SysH=1.0;MemU=4803;MemF=3241;SwpU=4927;SwpF=11160;PrcC=81;PrcTpCPU=(5140)C:\tools\eclipse\eclipse.exe=0.06, (3932)C:\Program Files\Java\jdk1.7.0_03\bin\javaw.exe=0.05, (2996)C:\Windows\system32\Dwm.exe=0.01, (4752)C:\Program Files (x86)\Mozilla Firefox\firefox.exe=0.01, (4276)C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE=0.01;PrcTpMem=(3932)C:\Program Files\Java\jdk1.7.0_03\bin\javaw.exe=1847120, (5140)C:\tools\eclipse\eclipse.exe=1444200, (4752)C:\Program Files (x86)\Mozilla Firefox\firefox.exe=1106056, (3668)C:\Program Files\Windows Sidebar\sidebar.exe=771540, (4644)C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe=649716;CPUH=0.96;CPULd=0.07;CPUNonIdl=0.12;MemH=1.0;NetDownR=eth3=1552, eth2=1552, eth8=1552, eth15=1552, eth16=1552;NetUpR=eth3=1123, eth2=1123, eth8=1123, eth11=0, eth13=0, eth12=0, eth15=1123, eth14=0, eth16=1123;

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

This looks like a classic example for a REPORT;

props.conf

[your sourcetype]
REPORT-blah = asdf

transforms.conf

[asdf]
DELIMS = ";", "="

read more here;

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Createandmaintainsearch-timefieldextractio...

http://docs.splunk.com/Documentation/Splunk/6.0/admin/Transformsconf

Hope this helps,

K

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...