Splunk Search

need to help to extract few fields

pench2k19
Explorer

Hi Team,

I have the following as raw event

INFO : [0:HLog][20200507 12:25:25.739 -0400] [CFarmdHealth.java:538] +1{"garbage_collec: {"total_collections_time":16539,"last_minute_collections":5,"last_minute_collections_time.:38,"totalcollections":2313},"current_state":
{"event_processing_metric":0.6647058823529413,"message_queues":{"maintenanceWindowManager":"0/-","Hibernate":"0/-","Default Cookbook":"0/-","Alert Workflows":"0/-",.StatCollector":"0/-","bus_thread_pool":"0/-","Event Workflows":"0/-","SituationMgr":"0/-","SituationRootCause":"0/-","Remedy":.0/-","AlertBuilder":"0/-","TeamsMgr":"0/-","xMatters":"0/-","Housekeeper":"0/-","Situation Workflows":"0/-","Indexer":"0/-","MaintManager":"0/-","NCAlertBuilder":"0/-","SMCEnricher":"0/-","xmattersINS":"0/-",.AlertRulesEngine":"0/-"},"in_memory_entropies.:781,"cookbook_resolu _queue":0,"active_async_tasks_count":0},"interval_totals":{"created events":621,"created_external_situations.:0,"created_situations":0,"messages_processed": {"maintenanceWindowManager":621,"Default Cookbook":548,"Alert Workflows":621,"StatCollector":0,"Event Workflows":597,"situationRootCause":0,"SituationMgr":0,"AlertBuilder":597,"TeamsMgr":0,"xMatters":0,"Indexer":666,"Situation Workflows":0,"maintManager":666,"SMCEnricher":621,NCAlertBuilder":597,xMattersINS":0,"AlertRulesEngine":548},"alerts_added_to situations":0,"situation_db_update_failure":0},JVM_memor] {"heap_used":314179032,"heap_committed":488636416,"heap_init":195035136,"nonheap_committed":290652160,"heap_max":3107979264,"nonheap_init":7667712,"nonheap_used":263293720,"nonheap_max" 1},"totals":{"created_events":178016,"created_external_situations":0,"created_situations":0,"alerts_added_to situations":0,"situation_db_update_failure":0}}1+

Now i have to build the kind of tables in the attachment out of above highlighted text in the event, Can you please help

alt text

0 Karma

to4kawa
Ultra Champion

use code sample and check your sample before ask the question.

your log is wrong and some missing string.(where is [ vs ,JVM_memor] ? )

0 Karma

robinettdonWY
Path Finder

Have you tried using regex to capture and the extract the fields you need? |rex field=_raw "regex with capture groups goes here"
Or you can go to Settings>Fields>Field Extractions and create a new fields there by extracting what you need.

0 Karma

pench2k19
Explorer

@jkat54 @woodcock @sideview @vnravikumar can you please help

0 Karma

jkat54
SplunkTrust
SplunkTrust

What search have you tried and what questions do you have about the work you've attempted?

No one wants to do your job for you, but we'd all love to help you if you've got a specific problem.

0 Karma

pench2k19
Explorer

@jkat54 i have tried the followin in props.conf and try create fields using that

[pench_test]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SEDCMD = y/:/=/
category = Custom
pulldown_type = true
sedcmd = y/:/=/

But its not creating most of the necessery fields to write the SPL query and seeking help.

0 Karma

pench2k19
Explorer

attaching image for your referencealt text

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...