Splunk Search
Highlighted

Normalizing IBM log collector data into Splunk fields

Communicator

I'm trying to monitor log data that is displayed below, and extract the fields into ones that can be used in Splunk

Nov 6 07:51:03 S10125BA QAUDJRN: [JS@0 event="JS-Actions that affect jobs" eventtype="S-Start" sev="1" actualtype="JS-S" jobtype="Subsystem monitor" jobsubtype="No subtype" chgjob="ALLSYL100" chguser="QSYS" chgjobno="866512" effectiveuser="QSYS" jobdname="" jobdlibrary="" jobqname="" jobqlibrary="" outqname="*DEV" outqlibrary="" printerdevice="PRT01" librarylist="QSYS QSYS2 QHLPSYS QUSRSYS QGPL QTEMP" effgroupprf="" supplemental="" jrnseq="9863803" timestamp="20161106075103429000" jobname="ALLSYL100" username="QSYS" jobnumber="866512" effuser="QSYS" logicalpartition="001" admin_user="yes"]

The log should begin with JS@O event= The fields I'm Most interested in are :

JS@O event
eventtype
actual
type
jobtype
effective
user
timestamp
jobname
job
number
admin_user

I've tried using the Splunk field extractor but have had no luck pulling out the fields I need. Please help

0 Karma
Highlighted

Re: Normalizing IBM log collector data into Splunk fields

Legend

Hi johnward4,
when you have in your logs a pair "field=value" Splunk automatically extract fieds and shows them in Relevant Fields, so you don't need to create a custom extraction using regex.
Probably in your case the first field has a wrong name because there is a space between "JS@O" and "event" and because "@" is a special character that cannot be used in field names, but anyway it should be read as "event".
If you don't have automatic extraction, you could use regexes like the following:

JS@0 event\=\"(?<event>[^\"]*)\"

Bye.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: Normalizing IBM log collector data into Splunk fields

Communicator

I'm trying to test the regex extraction as Splunk is not auto extracting the fields. I need to first regex the timestamp that begin the log in Nov 6 07:51:03 format.

Then cut and start the next extracted field beginning after [ and extract and create fields for each field=value pair. Ending at the closing ].

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.