Good morning Team
i am quite new in splunk and am stuck here currently
trying to extract fields for following strings sourcetype is syslog (The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.)
MN category\Source: Local databases\r\nRule\Category: TEST CAtegory\r\nRule\Rule type: Test\r\n
field to be selected
MN Category\Source local database
Rule\Category TEST category
Rule\Rule Type: Test
Thank you in advance
It looks like each key/value pair is on its own line, and the keys are separated from the values by a :
. This may be a valid regex to use in transforms.conf
to extract the key/value pairs together:
[colon_separated_key_value]
REGEX = ^(?<_KEY_1>[^:]+):\s*(?<_VAL_1>.*)$
And in props.conf
:
[syslog]
REPORT-colon_separated_key_value = colon_separated_key_value
Check out the transforms.conf and props.conf documentation for more information.