Hi,
I have log in the following format:
time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|
In order to extract these fields, I used both props.conf and transform.conf:
props.conf:
[my_format]
REPORT-my_format = my_format
transform.conf:
[my_format]
FORMAT = $1::$2
REGEX = ([a-zA-Z0-9_]+)=([^|]+)
MV_ADD = true
I am able to get the following fields:
time=12345678
hostname=shayh
product=blade1<>blade2<>blade3
username:sha@gmail.com
I noticed that I have an issue only with multi-value fields extraction.
multi-value fields may contains many values separated by "<>".
How can I change my settings to support current behavior with multi-value fields extraction?
UPDATE:
I succeeded to split it using fields.conf and TOKENIZER but on Splunk UI I still see it as:
product=blade1<>blade2<>blade3
Is it possible to solve it too? maybe by replacing <> with \n)?
| makeresults
| eval _raw="time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|"
| kv
| eval product=split(product,"<>")
Hi, @shayhibah
please try Fields » Calculated fields » Add new
eval expression is #4
It looks like your current REGEX will work except for the 'username' field since it is not in K=V format. I would let Splunk extract the 'product' field as-is and use the split
function to break it up at search time.
I need it to be done automatically using configuration files and not on the search bar itself.
If the format is field1=value1|field2=value2|...
you can try:
TRANSFORMS
[pipe_eq]
DELIMS = "|", "="
PROPS
[my_format]
TRANSFORMS-delims = pipe_eq
its not working.
The current parsing is OK, I just need to support multi-value fields as well as single values.
Please share some sample data, anonymized as necessary.
@richgalloway
Hi,
Here is an example:
time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com
Right now the pairs are perfect but I would like that field 'product' (for example) will be multi-value