Hi,
I have the below data that I will be importing into splunk. Id like to be able to delimit based on the FIRST (and ONLY the first) colon in the line. How would I go about doing this?
Name: HD Front Driveway
IP: 0.0.0.0
ID: 11
Mac: D4:21:22:C9:B4:62
FW Ver: 3.0.02.51
Manufacturer: iControl
Model: iCamera2-C
Video Size: LARGE
Verified: true
RSSI: dB
Supported Video Formats: [MJPEG, FLV, RTSP]
Supported Video Codecs: [H264, MPEG4]
FLV URL:
MJPEG URL:
API Version: 3.3
MotionTurnedOn: true
MotionSensitivy: 1 (LOW)
Local Video Aspect Ratio: 16:9
Local Video Resolution: 1280:720
Remote Video Aspect Ratio: 16:9
Remote Video Resolution: 1280:720
As an alternative - the answer from @richgalloway creates index-time extractions - this would be a working config for search-time extractions:
props.conf
[yoursourcetype]
REPORT-multifields = yoursourcetype-multifields
transforms.conf
[yoursourcetype-multifields]
REGEX = \s*([^:]+):(.*)[\r\n]
FORMAT = $1::$2
I shamelessly copied the regex from @somesoni2's comment 😉
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂
As an alternative - the answer from @richgalloway creates index-time extractions - this would be a working config for search-time extractions:
props.conf
[yoursourcetype]
REPORT-multifields = yoursourcetype-multifields
transforms.conf
[yoursourcetype-multifields]
REGEX = \s*([^:]+):(.*)[\r\n]
FORMAT = $1::$2
I shamelessly copied the regex from @somesoni2's comment 😉
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂
Try these settings. You'll need more, like TIME_PREFIX
, etc., but these should handle the parsing.
props.conf:
[mysourcetype]
TRANSFORM-foo = foo
transforms.conf:
[foo]
REGEX = (?<_KEY_>[^:]+):\s*(?<_VAL_>[^\n]+)
@richgalloway, I had something similar but Empty Key displaces the regular expression ie. line 13 and 14 in the question:
FLV URL:
MJPEG URL:
Following is the regex I was using: https://regex101.com/r/6JmpLF/1
\s+([^:]+):\s+(.+)
This should work (making the values optional)
REGEX = \s*(?<_KEY_>[^:]+):(?<_VAL_>.*)[\r\n]
What have you tried so far?
well that is a fair question. I've not actually tried anything yet but I did look at KV_MODE=True but it appears that uses "=" as the delimiter and I wasn't sure how to change it. Then I'm looking at multiple ":" in a single line and thats where it went out of my ballpark.