Splunk Search

field extraction of usually ommited info

dominiquevocat
Motivator

Hi,

i have a couple of logfiles where there is one important "field" that splunk does not recognize because it is not made of alphanumeric characters.

The possible values are "<<<<<" or "<====" indidicating if the logged event happened on the frontend or the backend. Which of course is important information inf finding an error.

How can i (best case) define a tag for this so i could label instances with either "frontend" or "backend"?

Regards Dom

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

gkanapathy
Splunk Employee
Splunk Employee

You would use the "rex" command to do it similarly.

0 Karma

dominiquevocat
Motivator

Ok, look nice enough. Will try it. At pure search time i.e. with the search language would interest me however. i'm new to the product so please ignore my ignorance 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...