Splunk Search

field extraction of usually ommited info

dominiquevocat
Motivator

Hi,

i have a couple of logfiles where there is one important "field" that splunk does not recognize because it is not made of alphanumeric characters.

The possible values are "<<<<<" or "<====" indidicating if the logged event happened on the frontend or the backend. Which of course is important information inf finding an error.

How can i (best case) define a tag for this so i could label instances with either "frontend" or "backend"?

Regards Dom

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

gkanapathy
Splunk Employee
Splunk Employee

You would use the "rex" command to do it similarly.

0 Karma

dominiquevocat
Motivator

Ok, look nice enough. Will try it. At pure search time i.e. with the search language would interest me however. i'm new to the product so please ignore my ignorance 🙂

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...