Hello
I'm attempting to extract multiple fields at a time from eloquence db fwaudit logs, an example of which is below:
timestamp: 2016-12-08 12:04:38
ORDER-NO : +XXXX
CUST-NO : X
-CC-DOLLARS : XXX
+CC-DOLLARS : XXX
CREDIT-CARD-NO : "X"
CC-EXPIRE-DATE : "X"
ORDER-DATE : +XXXXXX
BILLING-TYPE : "X"
BILL-ISSUE-NO : "\000\000"
POSTED-DATE : +XXXXXX
POSTED-TIME : +XXXXXX
BILL-DATE : +XXXXX
I have tried field extraction through the Splunk Web wizards, both the regular expression and delimiters options. But the problem with that is you have to define the fields, where as with this there are multiple fields at a time (I'd want to extract whatever fields have "+" and "-" at the beginning) and the fields themselves can vary from log to log.
I have installed Splunk Common Information Model (CIM) hoping that may help but no luck, there is also no existing eloquence app which I hoped would help with field extraction.
Any suggestions I can work from? Thanks
If you want to catch the fields
having values starting with +/-
try this if you only want to list them:
your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| table field_name, field_value
If you want then to be separate fields try something ike this:
your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| eval myFields=mvzip(field_name, field_value, "~")
| mvexpand myFields
| rex field=myFields "(?<myFieldName>[^\~]+)~(?<myFieldValue>.*)"
| table myFieldName, myFieldValue
If you want to search on any of the above fields then you can use | search myFieldName="stringValue"
or somethign like |search myFieldValue="stringValue"
. For example if you want to search all the fieldNames starting with a +/-
like -CC-DOLLARS or +CC-DOLLARS
then you can try to append this right at then:
| search myFieldName="\+*" OR myFieldName="\-*"
Hi, thanks for your reply! I am getting some results back for this, however not everything I would like.
To clarify I'm looking for only the results on the left hand side with a "+" or "-", essentially the field names rather than the field results.
Would you be able to help further please? I'm completely new to regular expression and its all going over my head. Are there any resources on regex you would recommend I look at?
Thanks again