Getting Data In

Is it possible to create an event type field within a source type?

jorell
New Member

Hi,

I was wondering if it was possible to create a field within the source type that would show the event type.

Here is a record from my log:

2016-06-05T19:55:10,144  INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successful

I would like to have INFO (and other types, like ERROR, WARN etc) as their own field within the source type. How can I do this? I'm new to Splunk and am currently using Splunk Enterprise 6.4.

0 Karma

sundareshr
Legend

Use the field extractions page to extract fields by sourcetype. Here's docs on that. http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesearch-timefieldextractions

Once in IFX, chose to write your own regular expression and enter this. Make sure you set the right permissions, after creating the field.

,\d+\s*(?<type>\w+)

*OR*

(?<type>INFO|WARN|DEBUG|ERROR)
0 Karma

Raghav2384
Motivator

Hello @jorell, could you please more info? What i understand is you are looking to create a filed that will hold the INFO,ERROR and WARN values? Is that what you are looking for?

You can extract fields always using regular expressions and eval: https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands.

Just to give you an idea, i extracted the Value INFO and assigned it to the Key = Level(Log Level)

|gentimes start=-1|eval Event="2016-06-05T19:55:10,144 INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successfu"|rex field=Event "\s(?P\w+)\s"

Please provide more info with an example if this is not even close to what you're looking for.

Hope this helps!

Thanks,
Raghav

0 Karma

jorell
New Member

Each Log has a type of warning it is after the timestamp, as you've seen. I just want to be able to search for anything that is of the ERROR type, or of the WARN time. So, anyway I can do that will be fine. There is a comma, a number than the log type, which in my example is INFO.

0 Karma

jorell
New Member

Thanks for the speedy reply, btw

0 Karma

Raghav2384
Motivator

np 🙂 Please provide sample events with all possible patterns and we will help you with the dream extraction 🙂

Thanks,
Raghav

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...