Splunk Search

How to extract several fields?

tpaulsen
Contributor

Hello

we need to extract a lot of fields from the following log:

Example deleted.

What would be the best way to extract the fields?

We tried this:

props.conf

[TEST.log]
REPORT-TEST.log = transform-TEST.log

transforms.conf

[transform-TEST.log]

Deleted due to request

which is working just fine on Splunk 3, but on our Splunk 4 installation it sometimes doesn´t assign the correct values, especially the lines with the value "AxxxxxY" in it.

How do we have to change the transforms.conf so that it also works on Splunk 4?

What other options do we have?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

View solution in original post

tpaulsen
Contributor

sorry, i had to remove the data due to security requests. Maybe simply delete the whole entry then, please?

0 Karma

ftk
Motivator

This questions loses a lot of its value to the community without the examples, since the answers provided won't make as much sense as they do with the examples. Please consider adding the examples again, perhaps you can just censor them rather than remove them completely.

0 Karma

tpaulsen
Contributor

Sorry, not working.

0 Karma

tpaulsen
Contributor

Yes thank you! Works like a charm...as long as the log events have the exact same count of fields.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

are all the spaces spaces, or are some of them tabs, in which case, use DELIMS = " \t".

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

tpaulsen
Contributor

Thank you, that looks promising.
There is still a little problem. Some entries (the ones with APP-KUSY) are one field shorter. How will Splunk handle those? As said, in 3 it wasn´t a problem, in Splunk 4 fields are wildly filled.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...