Splunk Search

Tried DELIMS, REPORT but cannot get neither working

Esky73
Builder

sample data :

Number: 152119522
Date : 12/01/2015 12:00:00 AM, Execution Time: 1945
Area Code: 21
Area Name: reading
Road: 7789
Code: 230
Description: Backup Failed

I have successfully - managed to extract required fields individually but trying to do it another way using the colon as a delimiter but i cannot get it working - config files :

props.conf

[sourcetype]
TRANSFORMS-colons = colons
transforms.conf
 [colons]
 REGEX = (?<_KEY_1>\w+):\s+(?<_VAL_1>\S+) 

where am i going wrong - cheers.

0 Karma
1 Solution

gvmorley
Contributor

Hi there,

This should be possible. I have a go with your data using this in props.conf:

[test-ext]
TRUNCATE = 0
SHOULD_LINEMERGE = false
LINE_BREAKER = (NULL)
DATETIME_CONFIG = CURRENT
MAX_EVENTS = 100000
REPORT-test-ext = sourcetype-test-ext

You'd need to change the TRUNCATE, MAX_EVENTS and LINE_BREAKER to whatever works best for you. This was just for a quick test.

Also, if you want to use the Date from your data as the Index time, then take a look at the TIME_PREFIX and TIME_FORMAT options.

Then in transforms.conf:

[sourcetype-test-ext]
REGEX = ([^:]+):\s([^\r\n,]+)
FORMAT = $1::$2

Which gives me this in Splunk:

alt text

Hopefully that gets you closer to what you're looking for.

View solution in original post

gvmorley
Contributor

Hi there,

This should be possible. I have a go with your data using this in props.conf:

[test-ext]
TRUNCATE = 0
SHOULD_LINEMERGE = false
LINE_BREAKER = (NULL)
DATETIME_CONFIG = CURRENT
MAX_EVENTS = 100000
REPORT-test-ext = sourcetype-test-ext

You'd need to change the TRUNCATE, MAX_EVENTS and LINE_BREAKER to whatever works best for you. This was just for a quick test.

Also, if you want to use the Date from your data as the Index time, then take a look at the TIME_PREFIX and TIME_FORMAT options.

Then in transforms.conf:

[sourcetype-test-ext]
REGEX = ([^:]+):\s([^\r\n,]+)
FORMAT = $1::$2

Which gives me this in Splunk:

alt text

Hopefully that gets you closer to what you're looking for.

Esky73
Builder

thanks for your help

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...