I have some data which are of the following format:
etc. I would like to extract some fields so that
name above will become a field name and
status will become a value. So the data above would yield two extra fields:
Field2=seen. I know that those numbers always go from 1 to 7, and that
.name always precedes
I tried to make a transform like this:
[MySourceType] TRANSFORMS-myfield1 = transformed_1 ... TRANSFORMS-myfield7 = transformed_7
[transformed_1] REGEX = CommonPrefix\.1\.name=”([^”]*)”.*CommonPrefix\.1\.status=”([^”]*)” FORMAT = $1::$2 LOOKAHEAD= 1048576 ... [transformed_7] REGEX = CommonPrefix\.7\.name=”([^”]*)”.*CommonPrefix\.7\.status=”([^”]*)” FORMAT = $1::$2 LOOKAHEAD= 1048576
I'm using LOOKAHEAD because my data are quite long. I tried to use _KEY_1 + _VAL_1 capturing groups as well, instead of or in addition to FORMAT. Nothing worked - the fields are not extracted.
Any ideas on what to fix here?
Your regex would work! But you have a format issue; your double quotes are
windownized and therefore wrong 😉
This is working:
This is not working:
Hope this helps ...
The quotes are fine in transforms.conf, it's just this site that windownized them. So no, it's not that. I tried escaping them with backslashes, which also didn't work.
Your regex works on your provided sample event see http://pasteboard.co/gzVlDIRjH.png :
Make sure your
sourcetype matches, you placed the
props.conf on the parsing Splunk instance and restarted splunk afterwards.
I added capturing groups as suggested by adamsaul in the accepted answer and it started working. I also escaped double quotes with backslashes but I tried that before. Really strange...
Technically you have capturing groups as well, but I also used non-capturing groups so that Splunk doesn't interpret any other data (not that it should).
Glad it worked for you!