Hi
I am processing log files by running custom command which transforms the data that I have looked for e.g
(8=FIX.4.4|9=123|35=D|56=BLPUS|49=FMRFIBOOM|52=20120502-12:14:31|34=15|54=8|55=IBM|38=15200|44=27|11=Order8|21=2|60=20120502-12:14:31|40=7|10=118|)
becomes
(BeginString=FIX.4.4|BodyLength=123|MsgType=New Order - Single|TargetCompID=BLPUS|SenderCompID=FMRFIBOOM|SendingTime=20120502-12:14:31|MsgSeqNum=15|Side=Cross|Symbol=IBM|OrderQty=15200|Price=27|ClOrdID=Order8|HandlInst=Automated execution order,public,Broker intervention OK|TransactTime=20120502-12:14:31|OrdType=Limit or better|CheckSum=118|)
The fields (8=,9=,35=) are been extracted correctly and appearing under "Other Interesting Fields" but the new post processing fields (BeginString=,BodyLength=,MsgType=) are not been extracted to the "Other Interesting Fields" section.
Does anyone know how to configure Splunk to do this automatically when a search is run?
Thanks in advance
Matt
Did you give up on the CLEAN_KEYS? I thought you got that working.
If your keys are all numeric when you let splunk index the files (as I assume they are) you can add nice names through FIELDALIAS;
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addaliasestofields
In props.conf
[your sourcetype]
FIELDALIAS-blah 8 AS BeginString 9 AS BodyLength
etc etc
Hope this helps,
Kristian
Did you give up on the CLEAN_KEYS? I thought you got that working.
If your keys are all numeric when you let splunk index the files (as I assume they are) you can add nice names through FIELDALIAS;
http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addaliasestofields
In props.conf
[your sourcetype]
FIELDALIAS-blah 8 AS BeginString 9 AS BodyLength
etc etc
Hope this helps,
Kristian
Hello again Kristian
Yes using Field Alias has worked.
Thanks for the suggestion
Mat