Splunk Search

field extraction of usually ommited info

Motivator

Hi,

i have a couple of logfiles where there is one important "field" that splunk does not recognize because it is not made of alphanumeric characters.

The possible values are "<<<<<" or "<====" indidicating if the logged event happened on the frontend or the backend. Which of course is important information inf finding an error.

How can i (best case) define a tag for this so i could label instances with either "frontend" or "backend"?

Regards Dom

1 Solution

Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

View solution in original post

Splunk Employee
Splunk Employee

e.g.:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)

You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:

props.conf:

[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc

transforms.conf:

[enddesc]
filename = enddesc.csv

lookups/enddesc.csv:

end,enddesc
"<<<<<","frontend"
"<====","backend"

This will also allow you to search on enddesc="frontend", which will work the same as end="<<<<<"

View solution in original post

Splunk Employee
Splunk Employee

You would use the "rex" command to do it similarly.

0 Karma

Motivator

Ok, look nice enough. Will try it. At pure search time i.e. with the search language would interest me however. i'm new to the product so please ignore my ignorance 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!