Splunk Search

Missing Event details when trying to Extract Fields from an Active Directory event

mpatnode
Path Finder

I have the following raw AD event which I can see from my search:

08/16/2010 12:55:56.0110
dcName=w2k3r2.demo.dev
admonEventType=Update
Names:
    objectCategory=CN=Service-Connection-Point,CN=Schema,CN=Configuration,DC=demo,DC=dev
    name=bsmith
    displayName=$CimsUserVersion2
    distinguishedName=CN=bsmith,CN=Users,CN=default,CN=Zones,CN=Centrify,CN=Program Data,DC=demo,DC=dev
    cn=bsmith
Object Details:
    objectGUID=cffb0829-0642-134c-2ef1-f03cc696e10b
    whenChanged=20100816195556.0Z
    whenCreated=20070906020209.0Z
    objectClass=top|leaf|connectionPoint|serviceConnectionPoint
Event Details:
    uSNChanged=127046
    uSNCreated=14129
    instanceType=4
Additional Details:
    keywords=foo:1111|bar:3333|too:3333
    showInAdvancedViewOnly=TRUE

Whenever I try to use the "Extact Fields" UI, the event is truncated after "Event Details" in the "Sample events" frame. What's preventing me from seeing the entire event?

1 Solution

carasso
Splunk Employee
Splunk Employee

In order to prevent the limited screen real estate from exploding, sample events are truncated at 15 lines (with at most 100 events). I have filed a request for improvement.

From the standard search view, you can still manually test out a regex with the 'rex' search command, and when it works, manually add that regex to your source or sourcetype from the Manager (i.e., Manager » Fields » Field extractions)

View solution in original post

carasso
Splunk Employee
Splunk Employee

In order to prevent the limited screen real estate from exploding, sample events are truncated at 15 lines (with at most 100 events). I have filed a request for improvement.

From the standard search view, you can still manually test out a regex with the 'rex' search command, and when it works, manually add that regex to your source or sourcetype from the Manager (i.e., Manager » Fields » Field extractions)

carasso
Splunk Employee
Splunk Employee

unfortunately, no.

0 Karma

mpatnode
Path Finder

Well that explains that. I did figure out how to use 'rex' as a work around. The next question is can I do dynamic field name generation the same way Splunk does? Something like this:

sourcetype="ActiveDirectory" keywords=* | rex field=_raw "keywords=(?<_KEY_1>[a-z]):(?<_VALUE_1>[0-9])

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...