Splunk Search

How to create a multi-line field extraction

dowdag
Engager

I am using splunk free -- and have data in format of:

2019-06-06 11:10:10,029 "somedata" # - Start of event
TransId=(?\d+) # - I want to capture this value
- Logging More data on next line
PaymendId=(?\d+) #I want to capture this value -- End of event
2019-06-06 11:10:10,129 "somedata" - then next event with different logging info.

What needs to be set in the source type for this to work?

I was not able to create multi-line field exaction, I did use (?ms) but had no success.
Thanks for any help or suggestions.

0 Karma

martynoconnor
Communicator

If you are happy that the event format is very consistent and doesn't change much there's nothing to stop you using [\r\n] as an option in your sourcetype EXTRACT-blah=

That would only work, however, if Splunk recognises your events are multiline (i.e. you have already included event breaking statements in props.conf and have use SHOULD_LINEMERGE=true.

This works:

TransId=(?\d+)\s.+[\r\n]+.+[\r\n]PaymentId=(?\d+)\s

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...