Splunk Search

simple field extraction not working

pjmenon
Explorer

I've been breaking my head over this very simple field extraction.

My extraction (see eg., below) has problems because my time format has "-" and so do my other fields. I cannot specify the position of timestamp since I have 2-3 timestamps in an event. what is the best way to extract these fields?

props.conf

[source::C:\Documents and Settings\Sample]
TIME_FORMAT= %Y-%M-%D  %H:%M:%S
CHECK_FOR_HEADER = false 
REPORT-test = test


transforms.conf:

[test] 
DELIMS = ","
FIELDS = "severity", "alm_no", "site_id", "alm_type","rsv1", "start_time", "end_time","duration", "rsv2"


Sample in input file:

MINOR,56789,/aaa-bbb-bbb/tv-daop/Rkhkjkj #2/Shelf #2/jjj #1, FAIL, , 2010-06-24 21:57:46,2010-06-24 21:59:23,0 00:01:37,N/A

Splunk search result

Severity=MINOR |  alm_no=56789  |  site_id=/aaa/ |  start_time=-bbb-bbb/tv-d  |  end_time=o  |  duration=/Rkhkjkj #2/Shelf #2/jjj #1 |  rsv2_par=FAIL 
Tags (1)
0 Karma

pjmenon
Explorer

Notice dashes in my field #3? "aaa-bbb-bbb" . these interfear with my formatting TIME-FORMAT. Doesn't matter if the date is in upper or lower case. Doesn't matter if you specifiy the position or not. Even afetr I did changes that you mentioned above, the same problem exists. If I just remove the dashes in field #3, things work fine even with my original conf file. One more thing to note is that I need to extract 2-3 valid timestamps in an event.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...