All Apps and Add-ons

getting an error while doing field extraction for the logs via syslog

markcomlinks
New Member

Good morning Team
i am quite new in splunk and am stuck here currently

trying to extract fields for following strings sourcetype is syslog (The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.)
MN category\Source: Local databases\r\nRule\Category: TEST CAtegory\r\nRule\Rule type: Test\r\n

field to be selected

MN Category\Source local database
Rule\Category TEST category
Rule\Rule Type: Test

Thank you in advance

Tags (1)
0 Karma

micahkemp
Champion

It looks like each key/value pair is on its own line, and the keys are separated from the values by a :. This may be a valid regex to use in transforms.conf to extract the key/value pairs together:

[colon_separated_key_value]
REGEX = ^(?<_KEY_1>[^:]+):\s*(?<_VAL_1>.*)$

And in props.conf:

[syslog]
REPORT-colon_separated_key_value = colon_separated_key_value

Check out the transforms.conf and props.conf documentation for more information.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...