Greetings fellow Splunkers (and Splunkettes),
Yet another field extraction question I'm afraid.
I have two log file types: we_accesslog_extsqu and mms_export_e_wms_90.
My field extraction for the mms logs works, however the we logs do not, despite being identically configured.
Here are my configs:
props.conf
[mms_export_e_wms_90]
pulldown_type=true
KV_MODE=none
SHOULD_LINEMERGE=false
TZ=Australia/Melbourne
TRANSFORMS-comment=mms_export_e_wms_90_comment
REPORT-header=mms_export_e_wms_90_fields
[we_accesslog_extsqu]
pulldown_type=true
KV_MODE=none
SHOULD_LINEMERGE=false
TZ=Australia/Melbourne
TRANSFORMS-toNull=we_accesslog_extsqu_header,we_accesslog_extsqu_footer
REPORT-weFields=we_accesslog_extsqu_fields
transforms.conf
[mms_export_e_wms_90_comment]
REGEX=^#
DEST_KEY=queue
FORMAT=nullQueue
[mms_export_e_wms_90_fields]
DELIMS = " "
FIELDS = "c-ip", "date", "time", "c-dns", "cs-uri-stem", "c-starttime", "x-duration", "c-rate", "c-status", "c-playerid", "c-playerversion", "c-playerlanguage", "cs(User-Agent)",
"cs(Referer)", "c-hostexe", "c-hostexever", "c-os", "c-osversion", "c-cpu", "filelength", "filesize", "avgbandwidth", "protocol", "transport", "audiocodec", "videocodec", "channelURL", "sc-bytes", "c-bytes", "s-pkts-sent", "c-pkts-received", "c-pkts-lost-client", "c-pkts-lost-net", "c-pkts-lost-cont-net", "c-resendreqs", "c-pkts-recovered-ECC", "c-pkts-recovered-resent", "c-buffercount", "c-totalbuffertime", "c-quality", "s-ip", "s-dns", "s-totalclients", "s-cpu-util", "cs_user_name", "s_session_id", "s_content_path", "cs_url", "cs_media_name", "c_max_bandwidth", "cs_media_role", "s_proxied", "SE-action", "SE-bytes", "Username"
[we_accesslog_extsqu_header]
REGEX = ^C
DEST_KEY = queue
FORMAT = nullQueue
[we_accesslog_extsqu_footer]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue
[we_accesslog_extsqu_fields]
DELIM = " "
FIELDS = "Current-Time", "Time-to-Serve", "Client-IP", "Request-Desc/Status-Returned", "Bytes-Xferred", "Method", "URL", "MIME-Type"
I'm happy to provide samples of the logs if they'll help?
As far as I can tell, both configurations are (in principle) identical, yet I cannot get Splunk to recognise the we_accesslogs_extsqu fields... can anyone possibly help me shed some light on this please?
