Splunk Search

How to extract fields depending on log message type?

dotandvir
Engager

Hi,

I have a log file consisting of log entries with the following format:
data time source message_type optional_qualifier param1, param2,...,param_n

The parameters value only (i.e. not of the type name=value). What would be the easiest way to extract parameter number 3 or 4 and assign them to a field?

Dotan

Tags (2)
1 Solution

Raghav2384
Motivator

Several ways to do it. Using Transforms.conf with delim option.
Or use ondemand rex. http://docs.splunk.com/Documentation/Splunk/6.1.4/Admin/transformsconf

View solution in original post

Raghav2384
Motivator

Several ways to do it. Using Transforms.conf with delim option.
Or use ondemand rex. http://docs.splunk.com/Documentation/Splunk/6.1.4/Admin/transformsconf

Raghav2384
Motivator

This is very high level example:
Sample log: 2012-10-20 15:23:59 abc123|cyz234|xaycvbd|sedghyrd|scvbdg|10002345000

In my Transforms.conf, this would be the entry
[MyStanza]
DELIMS = "|"
FIELDS = "F001","F002","F003"
And then,add ref in
Props.conf
[MyFields]
REPORTS-foo = MyStanza.

Results, you should have F001 = abc123, F002=cyz234 and so on....
Hope this is what you're looking for.

Thanks,
Raghav

dotandvir
Engager

Thank you, do you have a step by step process for doing so? I am a bit confused about what needs to be done in what order.

Dotan

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...