Splunk Search

Extracting Logs at Whitespace

_gkollias
SplunkTrust
SplunkTrust

Right now, I have a name=value|name=value| format for some logs.

But one problem is the Splunk auto-extract for that data stops working at white-space when there's no quotes around the data

For example, the field Message:

For one of the Failures, Message should equal "Message=Failed to deploy configurations to aliases [CITST:serverName,CITST:serverName,CITST:serverName,]"

But when I see it in results I just have Message=Failed. There's way to do it in the search, but defining some props for that would help out.

Does anyone know what I could add to my props.conf to make this successful?

Thank you!

Tags (2)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

There are many different ways to do this. You could edit props.conf and defint an EXTRACT for the sourcetype to manually extract the field.

Probably the easiest though would be to try to first use the Splunk web UI to do the field extraction.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesearch-timefieldextractions

View solution in original post

okrabbe_splunk
Splunk Employee
Splunk Employee

There are many different ways to do this. You could edit props.conf and defint an EXTRACT for the sourcetype to manually extract the field.

Probably the easiest though would be to try to first use the Splunk web UI to do the field extraction.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesearch-timefieldextractions

_gkollias
SplunkTrust
SplunkTrust

Awesome I'll try it out. Thank you very much for your help!

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Yup. You do not want anyway whitespace between extract and eisci.

something like:
EXTRACT-eisci = message="(?[^"]+)"

You may need to restart after you update this.

_gkollias
SplunkTrust
SplunkTrust

so do something like

EXTRACT - eisci = ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...