Splunk Search

How to extract a complex field

mfscully
Explorer

I have a log that has the following:
Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah HandleSomethingElse=31951592=460892.509 Blah ...

I want to extract the following:
HandleBusInfoMessageCount=31951592
HandleBusInfoMessageTime=460892.509

HandleSomethingElseCount=31951592
HandleSomethingElseTime=460892.509

The command name (Handle*) can be variable.
Thanks for the help in advance.

Tags (1)
0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You could use the Interactive Field Extractor to do this

  1. Go to the event
  2. Click "Event Actions"
  3. Click "Extract Fields"
  4. Copy examples of the fields you want from your data into the examples box
  5. Test generated regex, edit as needed.
  6. Save as field extraction

See this guide (for 6.1).

Note this process becomes significantly easier in 6.2.

0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

After you use the field extractor, you can edit the regex that is generated so that it can accommodate any of the values that might be seen. e.g. [\w\d_+] instead of where it might have generated "Handle". Then you can retest the extraction, and repeat until its perfect.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...