Splunk Search

How to extract several fields?

tpaulsen
Contributor

Hello

we need to extract a lot of fields from the following log:

Example deleted.

What would be the best way to extract the fields?

We tried this:

props.conf

[TEST.log]
REPORT-TEST.log = transform-TEST.log

transforms.conf

[transform-TEST.log]

Deleted due to request

which is working just fine on Splunk 3, but on our Splunk 4 installation it sometimes doesn´t assign the correct values, especially the lines with the value "AxxxxxY" in it.

How do we have to change the transforms.conf so that it also works on Splunk 4?

What other options do we have?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

View solution in original post

tpaulsen
Contributor

sorry, i had to remove the data due to security requests. Maybe simply delete the whole entry then, please?

0 Karma

ftk
Motivator

This questions loses a lot of its value to the community without the examples, since the answers provided won't make as much sense as they do with the examples. Please consider adding the examples again, perhaps you can just censor them rather than remove them completely.

0 Karma

tpaulsen
Contributor

Sorry, not working.

0 Karma

tpaulsen
Contributor

Yes thank you! Works like a charm...as long as the log events have the exact same count of fields.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

are all the spaces spaces, or are some of them tabs, in which case, use DELIMS = " \t".

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

tpaulsen
Contributor

Thank you, that looks promising.
There is still a little problem. Some entries (the ones with APP-KUSY) are one field shorter. How will Splunk handle those? As said, in 3 it wasn´t a problem, in Splunk 4 fields are wildly filled.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...