Splunk Search

How to extract a complex field

mfscully
Explorer

I have a log that has the following:
Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah HandleSomethingElse=31951592=460892.509 Blah ...

I want to extract the following:
HandleBusInfoMessageCount=31951592
HandleBusInfoMessageTime=460892.509

HandleSomethingElseCount=31951592
HandleSomethingElseTime=460892.509

The command name (Handle*) can be variable.
Thanks for the help in advance.

Tags (1)
0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You could use the Interactive Field Extractor to do this

  1. Go to the event
  2. Click "Event Actions"
  3. Click "Extract Fields"
  4. Copy examples of the fields you want from your data into the examples box
  5. Test generated regex, edit as needed.
  6. Save as field extraction

See this guide (for 6.1).

Note this process becomes significantly easier in 6.2.

0 Karma

mfscully
Explorer

One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

After you use the field extractor, you can edit the regex that is generated so that it can accommodate any of the values that might be seen. e.g. [\w\d_+] instead of where it might have generated "Handle". Then you can retest the extraction, and repeat until its perfect.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...