Splunk Search

Splunk field seperators

timbCFCA
Path Finder

I love Splunk's ability to dynamically pull fields at runtime with name=value pairs.
I have several log formats which have a "key name: value" format or similar. The exact settings are:

There may potentially be spaces in both the key name and value
There are always two spaces between the colon and the value
The value may be blank
Each set of values is separated by three or four spaces

Subject:   Security ID:  S-1-5-18   Account Name:  ACCOUNT$   Account Domain:  DOMAIN   Logon ID:  0x3e7    Process Information:   New Process ID:  0x1bdc  Another Field:  Test Results negative   

The regex I'm trying to use for my extraction is

\s\s\s([^\s]+):\s\s(.*)\s\s\s

Where am I going wrong?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Use a regex that extracts the key and the value in transforms.conf.

[with_colon]
REGEX = \t([^\s:]+):\s(\S+)\t
FORMAT = $1::$2

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I suppose the problem if the key or value may contain spaces is, how do you tell when one end and other begins, e.g., if you see:

one two: three four five: six seven eight nine: ten eleven: twelve

What would be the field names and what would be the values? Apparently one two is a field, but is its value three or three four? And so on.

If you can define that, then a regex can be created, but the idea is kind of what is in Ayn's answer.

0 Karma

timbCFCA
Path Finder

There should be a tab character between each set of fields so appending and prepending to the regex from Ayn should do the trick. I'll try it out and see how it goes.

0 Karma

Ayn
Legend

Use a regex that extracts the key and the value in transforms.conf.

[with_colon]
REGEX = \t([^\s:]+):\s(\S+)\t
FORMAT = $1::$2

timbCFCA
Path Finder

Ayn, many thanks. I've done some additional research on the message format and updated the question accordingly. Could you take a look at what I need in the way of a regex?

0 Karma

Ayn
Legend

True, I missed that in the question! Editing to reflect on that, and the info that tabs are at the start and end of each k/v pair.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

well, the field name may include spaces.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...