My ultimate goal is to create a regex expression that can be used use to extract fields from any record made up comma-seperated fields. For example, if a normal event looks like this:
"RADSP01HDQRW","IAS",04/02/2012,16:14:38,2,,"RETAIL\HH01-9002",,,,,,,,0,"10.170.191.48"
it will always contain 15 commas, therefore 16 fields.
I created the regex expression below and tested it with UltraEditPro.
[^,](?=(,[^,]){15,15}$)
It will find the 1st field. In order to make it find the 2nd field I simply replace (15,15) with (14,14).
Everything looked great in UltraEdit but when I pasted it into the Field Extraction UI
it complained...
Invalid regex: no named extraction at position 7 (i.e., "=(,[^,]*){..."). Expected "(?P
pattern)"
I tried various combinations before thinking surely someone else has already tackled this problem... so here's hoping!
Since you have a delimiter that is separating your fields then I would take a look at the following:
$SPLUNK_HOME/etc/system/local/props.conf
[data]
REPORT-fieldextract = fieldextract
$SPLUNK_HOME/etc/system/local/transforms.conf
[fieldextract]
DELIMS = ","
FIELDS = field1,field2,field3,...field16
Remember that this field extraction happens at index time so this will only work for the latest data.
Here is a link to more information:
http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Transformsconf
Since you have a delimiter that is separating your fields then I would take a look at the following:
$SPLUNK_HOME/etc/system/local/props.conf
[data]
REPORT-fieldextract = fieldextract
$SPLUNK_HOME/etc/system/local/transforms.conf
[fieldextract]
DELIMS = ","
FIELDS = field1,field2,field3,...field16
Remember that this field extraction happens at index time so this will only work for the latest data.
Here is a link to more information:
http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Transformsconf
Fields extractions are on the search head then if your indexer is the search head too then you should put it there.
Your sencond extraction via delims looks right.
Thanks for the reply. I read the props and transforms documentation and am unclear if the edits need to be in these files on the indexer or the UF.
Also, if I want to extract the csv fields only for sourcetype=foo, does this look right?
Props.conf [sourcetype::foo]
report_radius=extract_radius_CSV
Transforms.conf: [extract_radius_CSV]
DELIMS=”,”
FIELDS=”nps_svrName”,”nps_svcName”,”nps_Date”,”nps_Time”,”nps_packetType,”nps_userName”,”nps_userFQDN”,”nps_calledStation”,”nps_callingStation”