All Apps and Add-ons

Splunk DB Connect 2.3.0: How to properly extract fields from database events that contain spaces in the field names?

bharathkumarnec
Contributor

Hello All,

We are using Splunk DB Connect 2.3.0. Below are the sample of events:

Severity Code = "103",Transition Code="111"

"Severity Code" & Transition Code" are not showing in the fields list. Instead, we are able to see only fields with name "Code", as there is a white space in between the two words of the field names.

How to extract fields completely with "Severity Code" & "Transition Code"?

Kindly help me out.

Regards,

0 Karma

rodrigorsilva
Communicator

It would be simpler to adjust the input, avoid writing a regex...

Example: Select `Severity Code` as Severity_Code, `Transition Code` as Transition_Code from [your_table] ...

Tks

Rodrigo Ribeiro

0 Karma

bharathkumarnec
Contributor

We have not explicitly specified sourcetype for these events, our db connect app configured in Search head server.

If we need to specify the sourcetype, what all we need to include and this sourcetype stanza should be in searchhead, indexer or both??

Thanks for your help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's a Splunk Best Practice to explicitly specify a sourcetype for all inputs. It should be defined on the node where DB Connect is running. Choose the best props.conf settings for your data. If you elect to use REGEX string, this one may get you started: Severity Code = "(?<severity>\d+)",Transition Code="(?<transition>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What sourcetype are you using and what are the props.conf settings for that sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...