Splunk Search

How to autofill field name with field extraction or dynamic rex statement?


So I have the following data in the log file and would like to be able to search on the specific field name, but unfortunately the data is not in key=value or key:value it's in {"key","value"} format.

Is there any way to do field extraction or a dynamic rex statement to auto-fill the fieldname slot?

Example Data set #1:

{"createtime","2014-08-12 16:36:58"}

Example Data set #2:

{"Comp.adjunct..menuname"," "}
{"Comp.adjunct..timestamp","2014-08-12 11:28:08.681"}

Since I cannot guarantee the order or that all the fields will be present the only way I can think of achieving this is:

| fields _raw
| rex field=_raw "\{\"type\",\"(?<type>.*?)\"\}"
| rex field=_raw "\{\"primary_ani\",\"(?<primary_ani>.*?)\"\}"
| rex field=_raw "\{\"dest\",\"(?<dest>.*?)\"\}"
| rex field=_raw "\{\"orig\",\"(?<orig>.*?)\"\}"
| where type="voice" AND dest!="" | table *
0 Karma


You have one option which to create a transform for your sourcetype. Below is a props and transfroms created from your sample data. I've tested this against the sample and it works, milage may vary.

REPORTS-spam = spam

REGEX = {"([^"]+)","([^"]+)"}
FORMAT = $1::$2

Hopes this helps.


0 Karma


Define a transforms.conf stanza like this:

REGEX = \{"(?<_KEY_1>[^"]+)","(?<_VAL_1>[^"]+)"\}

Apply that your your sourcetype in props.conf like this:

REPORT-foo = some_key_value_name

Those two magic field names handle extraction of both the field name and field value in one go. See http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/transformsconf for reference.

Note, my regex expects no escaped double quotes in either the field name or value. If that can happen then you need to be a bit more careful with the expression.

0 Karma