Splunk Search

How to extract a complex field

mfscully
Explorer

I have a log that has the following:
Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah HandleSomethingElse=31951592=460892.509 Blah ...

I want to extract the following:
HandleBusInfoMessageCount=31951592
HandleBusInfoMessageTime=460892.509

HandleSomethingElseCount=31951592
HandleSomethingElseTime=460892.509

The command name (Handle*) can be variable.
Thanks for the help in advance.

Tags (1)
0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You could use the Interactive Field Extractor to do this

  1. Go to the event
  2. Click "Event Actions"
  3. Click "Extract Fields"
  4. Copy examples of the fields you want from your data into the examples box
  5. Test generated regex, edit as needed.
  6. Save as field extraction

See this guide (for 6.1).

Note this process becomes significantly easier in 6.2.

0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

After you use the field extractor, you can edit the regex that is generated so that it can accommodate any of the values that might be seen. e.g. [\w\d_+] instead of where it might have generated "Handle". Then you can retest the extraction, and repeat until its perfect.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...