Need help with multiple field extractions

[moshiro]

Wanted to know the best way to extract multiple fields along with their associated values. I have a log that I need to about 10 fields extracted. The values are updated every five minutes.

Here is example of the log:
2014-12-04 15:56:01 dbsize 5628245
2014-12-04 15:56:01 mem_fragmentation_ratio 1.24
2014-12-04 15:56:01 used_cpu_sys 366988.84
2014-12-04 15:56:01 used_cpu_user_children 255506.31
2014-12-04 15:56:01 used_memory 1401843904
2014-12-04 15:56:01 used_memory_human 1.31G

[MuS · Accepted solution]

Hi moshiro,

as @sk314 wrote, change the log format to key=value or field=value pairs and Splunk will do this on its own. If not possible use props.conf and transforms.conf to make it happen like this:

props.conf
[yoursourcetype]
REPORT-GetmyKV = GetMyKeyValue

transforms.conf
[GetMyKeyValue]
REGEX = \:\d{2}\s(.*?)\s(.*)
FORMAT = $1::$2

This will put matching group1 as key/field and matching group2 as value.

hope this helps ...

cheers, MuS

[sk314]

Splunk can automatically extract field=value pairs. so if you have timestamp field1=value1 field2=value2 and so on ... splunk would automatically do the extraction for you. Naturally this only works if you have control over the logging format.

If that is not in your hand (log format), you could try using the interactive field extractor to specify simple regex based extraction for your fields.