Splunk Search

How to extract several fields?

Contributor

Hello

we need to extract a lot of fields from the following log:

Example deleted.

What would be the best way to extract the fields?

We tried this:

props.conf

[TEST.log]
REPORT-TEST.log = transform-TEST.log

transforms.conf

[transform-TEST.log]

Deleted due to request

which is working just fine on Splunk 3, but on our Splunk 4 installation it sometimes doesn´t assign the correct values, especially the lines with the value "AxxxxxY" in it.

How do we have to change the transforms.conf so that it also works on Splunk 4?

What other options do we have?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

View solution in original post

Contributor

sorry, i had to remove the data due to security requests. Maybe simply delete the whole entry then, please?

0 Karma

Motivator

This questions loses a lot of its value to the community without the examples, since the answers provided won't make as much sense as they do with the examples. Please consider adding the examples again, perhaps you can just censor them rather than remove them completely.

0 Karma

Contributor

Sorry, not working.

0 Karma

Contributor

Yes thank you! Works like a charm...as long as the log events have the exact same count of fields.

0 Karma

Splunk Employee
Splunk Employee

are all the spaces spaces, or are some of them tabs, in which case, use DELIMS = " \t".

0 Karma

Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

View solution in original post

Contributor

Thank you, that looks promising.
There is still a little problem. Some entries (the ones with APP-KUSY) are one field shorter. How will Splunk handle those? As said, in 3 it wasn´t a problem, in Splunk 4 fields are wildly filled.

0 Karma