How to extract several fields?

[tpaulsen]

Hello

we need to extract a lot of fields from the following log:

Example deleted.

What would be the best way to extract the fields?

We tried this:

props.conf

[TEST.log]
REPORT-TEST.log = transform-TEST.log

transforms.conf

[transform-TEST.log]

Deleted due to request

which is working just fine on Splunk 3, but on our Splunk 4 installation it sometimes doesn´t assign the correct values, especially the lines with the value "AxxxxxY" in it.

How do we have to change the transforms.conf so that it also works on Splunk 4?

What other options do we have?

[tpaulsen]

sorry, i had to remove the data due to security requests. Maybe simply delete the whole entry then, please?

[ftk]

This questions loses a lot of its value to the community without the examples, since the answers provided won't make as much sense as they do with the examples. Please consider adding the examples again, perhaps you can just censor them rather than remove them completely.

[tpaulsen]

Sorry, not working.

[tpaulsen]

Yes thank you! Works like a charm...as long as the log events have the exact same count of fields.

[gkanapathy]

are all the spaces spaces, or are some of them tabs, in which case, use DELIMS = " \t".

[gkanapathy · Accepted solution]

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

[tpaulsen]

Thank you, that looks promising.
There is still a little problem. Some entries (the ones with APP-KUSY) are one field shorter. How will Splunk handle those? As said, in 3 it wasn´t a problem, in Splunk 4 fields are wildly filled.