About lwm4p

lwm4p · ‎08-15-2014

That gives me the chart I am looking for! Not sure I really get what all this does... Will have to research the different mv stuff.. is there a good help site on what each function does and what the params are?

lwm4p · ‎08-15-2014

Thank you, I definitely plan to add these as config fields. My original regex seems to work fine though, but you say that mine won't capture the first 0? It seems to, but maybe I am missing something.

lwm4p · ‎08-15-2014

This was too long to put in the comments, so am posting it here: tom_frotscher That seems to work great... I can see the correct values (and multiple values) when I view the events. It correctly splits out the carriers and errors into multiple values. rex max_match=25 "(?<carrier>\d+)\[(?<error>\-?\d+\.?\d+)\]"| search error="*" Now that I am trying the next step (graphing it), I have a feeling that this might have been the wrong route. My ultimate goal is to have a graph of errors by carrier, which means that the carrier and error need to be related across events. So as events like this come in, the error for carrier 1 will fluctuate. I want to see a graph of the errors for carrier 1 over time. Eventually, I would put them all on the same graph, so that I have a line graph where each line represents a carrier, the x-axis is time and the y-axis is error value. Kind of like this, but these values are all messed up: https://www.dropbox.com/s/ie56feayop1q9ln/carrier_chart.PNG Am I just expanding these variables incorrectly? or am I setting this up totally wrong?

lwm4p · ‎08-14-2014

Hello, I have a log file with a bunch of entries like this: <carrier-index>[<error>]: 0[0], 1[0.0363152], 2[0.0228264], 3[0.0515129], 4[0.0123894], 5[0.128875], 6[0.0917961], 7[0.0460198], 8[0.81137], 9[-0.105347], 10[0.538207], 11[999], 12[999], 13[999], 14[999], 15[999], 16[0.74948], 17[0.0690911], 18[0.709686], 19[-0.184876], 20[999] As it states at the very beginning, the first number is the carrier-index and the number in brackets is the error. This lines above come as one event and I am trying to extract the index and the error. Since this is two variables with multiple values in one event, I think I need to use a multi-value field... just not sure exactly how to do it. This will extract the very first one.. I think I just do a repeat of this once they are multi-value fields? (?<carrier>\d+)\[(?<error>\-?\d+\.?\d+)\] how do I get both the fields 'carrier' and 'error' to be multi-value and then get it to pick up all the values? My end result would then be a graph with all the carriers showing the error values over time.

lwm4p · ‎08-14-2014

Well, I have figured out a few things last night that helped me understand why things sometimes don't show.. writing it here for other newbies to reference. Thanks to everyone for responding, the answers definitely helped me eliminate things: The regex for an extracted field has to be perfect, or the field will not show. I started using an app that helps me write the extractions (search in the app area) and that helped out a lot. Using the cloud version is a bit tough because I didn't have access to the props.conf. When I installed locally, I could watch when files changed and understand where I should be putting different configuration stuff. Get the permissions correct, both on the field itself AND on the config files! For some reason, I would enter an extract field in teh GUI and no files were getting written... I changed the permissions at the OS level and it worked. The field will NOT show if the current set of data on the screen doesn't have it in the events. You must filter in search (by time or whatever) to get that event in the current area. Then the field shows. This goes for all fields, they are dynamic based on what data is up at the time, it doesn't just show all fields for your sourcetype all the time. A great quick tester for regex is notepad++ (I am sure there are others, but I already use that for other things). It is on the 'find' window, where you can enter your regex and search the file for it, verifying that works.

lwm4p · ‎08-08-2014

Ran that it is got rid of all the indexed stuff... at least, it then showed zero events and the data screen said 'Waiting for Data'. I reloaded the log file in, checked to make sure the extraction field was still there, and then to the search area. Still has the defaults and my field does not show. I feel like I am missing something simple... I really appreciate your help on this. Maybe this is a problem with the cloud sandbox instance?

lwm4p · ‎08-08-2014

Hmm... still doesn't show up. I modified my extraction field to the below and then went back to the search area and only the regular fields are there. https://www.dropbox.com/s/h821lgztz2tm5ef/extraction_field.PNG which has these params: Trace : EXTRACT-mac_address Inline Sensor (? (d|w{2}):(d|w{2}):(d|w{2}):(d|w{2}):(d|w{2}):(d|w{2})) rebooted admin search Global | Permissions Enabled Here is a pic of my search screen: https://www.dropbox.com/s/3314frx2bea5psf/Search_Screen.PNG

lwm4p · ‎08-08-2014

When I test this: sourcetype=Trace | rex "Sensor (? (\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2})) rebooted" It creates a field called 'example_mac' that shows on the left... While that is not surprising, it still leaves my original question open. I defined an extraction field called mac_address and that does not show up anywhere and does not seem to be able to be used. ??

lwm4p · ‎08-08-2014

I put in this string: sourcetype=Trace | table _raw | rex "Sensor (? ([0-9A-F]{2}[:-]){5}([0-9A-F]{2}))" I get every event returned, the field does not show up in the search field list, and my other field 'mac_address' goes away.

lwm4p · ‎08-08-2014

I finally got the field to show up... but am not really sure why or if it is even the configured extraction field. All I did was put this line in: sourcetype=Trace | rex "Sensor (? (\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2}):(\d|\w{2})) rebooted" All of a sudden, the field is now present on the left side of the search area and I could click on it and ask to graph it over time... got my graph. If anyone can explain that, please do.

lwm4p · ‎08-08-2014

OK, I have changed the regex for the extract field to that, thank you. My original problem still exists though, where this new field does not show up for me in the list of fields for search, how do I get it to show there?

lwm4p · ‎08-08-2014

ok, I am sure the regex is probably not correct. Will bad regex mean that the extract field does not even show? I guess I was expecting the field to show and then just have zero results or an error if the regex was bad... but the field not showing up at all made me think I have an earlier step wrong.

lwm4p · ‎08-08-2014

I am really new to Splunk, but I have searched the questions here and don't seem to find an answer to my problem. I have just started the online sandbox and am messing around with a log file from one of our applications (so it is a custom log file). A line in the log file looks like this: [08/03/14 03:07:49, 127.0.0.1, N/A] [Source: 10.50.2.15:55000] PresenceSensor: Sensor 00:00:CC:DD:00:00 rebooted What I want to do is extract the MAC Address from this line and then create a bar graph showing when this line was recorded for a particular MAC Address. I loaded in the file and I see the indexed data. It automatically separated the date out and the rest of the stuff is in the 'Event' column. I created an Extract Field with this config: Trace : EXTRACT-mac_address Inline ([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$ admin search Global | Permissions Enabled Now, I go back the search area and I don't see this field anywhere. Isn't it supposed to just show up? How do I make use of this extracted field? - I have check the sourcetype - I have opened up the 'More Fields' area and it is not there even with the 'All fields' option at the top - I have adjusted the permissions (they are completely global and for every app) What am I missing? It is probably something obvious, so please be gentle.

Posts	13
Solutions	1
Karma Given	1
Karma Received	5
Member Since	‎08-07-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to write regex to extract multi-value fields a...

How to extract MAC address from log file?

Re: How to write regex to extract multi-value fiel...

Re: How to write regex to extract multi-value fiel...

Re: How to write regex to extract multi-value fiel...

How to write regex to extract multi-value fields a...

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

Re: How to extract MAC address from log file?

How to extract MAC address from log file?