field extraction of usually ommited info

[dominiquevocat]

Hi,

i have a couple of logfiles where there is one important "field" that splunk does not recognize because it is not made of alphanumeric characters.

The possible values are "<<<<<" or "<====" indidicating if the logged event happened on the frontend or the backend. Which of course is important information inf finding an error.

How can i (best case) define a tag for this so i could label instances with either "frontend" or "backend"?

Regards Dom

[gkanapathy · Accepted solution]

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

[gkanapathy]

You would use the "rex" command to do it similarly.

[dominiquevocat]

Ok, look nice enough. Will try it. At pure search time i.e. with the search language would interest me however. i'm new to the product so please ignore my ignorance 🙂