Splunk Search

help to use EXTRACT in props.conf

avoelk
Communicator

I've been trying to extract fields from a log at search time with only the help of props.conf. in the spunk docu I read that EXTRACT would be good in that case, especially cause I try to extract multiple fields at once. 

 

this is my EXTRACT in props.conf so far:

 

 

EXTRACT-fields = (?P<src_ip>\d*\.\d*\.\d*\.\d*)(?=\ \d* TCP_)\s(?P<bits>\d*)\s(?P<tcp_state>\w*_\w*)\s

 

 

this would go on for a while with different fields but it doesn't work. what do I do wrong? 

this is how the log looks like for example: 

 

 

2014-03-27 12:39:32 20 10.71.15.207 304 TCP_HIT 367 1470 GET http www.computerworld.com 80 /elqNow/elqFCS.js - - - - 23.196.74.53 application/x-javascript http://www.computerworld.com/s/article/9247206/Gameover_malware_takes_aim_at_Monster.com_and_CareerBuilder.com "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" OBSERVED "Technology/Internet" - 163.252.254.201 23.44.202.53 52809

 

 

 

Thanks a lot for any help!

Labels (2)
0 Karma
1 Solution

avoelk
Communicator

yeah well I guess I have the solution again... *facepalm*. 

I've made an field extraction via splunk gui - settings - fields - field extraction and looked at the output. there it said the name of the extraction was 

EXTRACT-src_ip,bits,tcp_state

so using this in my props.conf instead of only -fields made it work.... gosh. 

hope this helps anyone who comes across this little problem. 

View solution in original post

0 Karma

avoelk
Communicator

yeah well I guess I have the solution again... *facepalm*. 

I've made an field extraction via splunk gui - settings - fields - field extraction and looked at the output. there it said the name of the extraction was 

EXTRACT-src_ip,bits,tcp_state

so using this in my props.conf instead of only -fields made it work.... gosh. 

hope this helps anyone who comes across this little problem. 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...