Splunk Search

Header extraction rename

ShaneNewman
Motivator

I am monitoring several BizTalk\MSMQ perfmon counters (Host Counters, General Counters, MSMQ Queue, MSMQ Service). I have setup field extraction based on the header row of this file, and it is garbage! For the General Counters, I was able to setup a transform in the props.conf to rip out the header and setup field extraction via KV because the column names never change. For the other 3, that is not the case.

Is there a way to setup some sort of regular expression to dynamically extract field names based on the header row?

Example:

"\\hostname\BizTalk:Message Box:Host Counters(HOST_COUNTER_NAME:biztalkmsgboxdb:HOSTNAME.test.test.net,56219)\Host Queue - Number of INSTANCES"

Becomes -> host_counter_name_instances

I have CAPITALIZED the location of the identifiers I need in the default header.

0 Karma
1 Solution

ShaneNewman
Motivator

I turned on the counters in WMI, then used the wql tool in Splunk to capture the data. Not idea but it did the job perfectly.

View solution in original post

ShaneNewman
Motivator

I turned on the counters in WMI, then used the wql tool in Splunk to capture the data. Not idea but it did the job perfectly.

ShaneNewman
Motivator

I know the regex to do the field extractions to create the name I want it to be.

I cannot find it documented anywhere if there is a way to dynamically create field names from the header row without indexing it - other than just using what the header row has in it to begin with...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...