Splunk Search

Can splunk do this? Extract a portion of an event. Then, index just the value and not the key=value pairs.

lpolo
Motivator

I have the following log event :

2013-03-12 10:37:10,205 { "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }

With the following query:

| rex field=_raw mode=sed "s/[rn]//g" 
| rex "<tvsquery id="(?&lt;id">[^>]+)>(?<response_temp>.+?)</tvsquery>"
| eval result="{\""."TimeStamp"."\"".":"."\""._time."\"".","."\""."id"."\"".":"."\"".id."\"".","."\""."response"."\"".":".response_temp."}" |table result

I am able to get the following result set:

result
{"TimeStamp":"1364556697.631","id":"58b6bf4d-948b-416b-8d17-cedcbc1059ec","response":{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }}

Problem:
How can index the value of result in a new summary index?
For this particular example I just need this:

{"TimeStamp":"1364556697.631","id":"58b6bf4d-948b-416b-8d17-cedcbc1059ec","response":{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }}

I do not want this in the index:

result = "{"TimeStamp":"1364556697.631","id":"58b6bf4d-948b-416b-8d17-cedcbc1059ec","response":{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }}"

Thanks,
Lp

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

to replace the _raw event, try

| eval _raw="< my long eval statement >"

to summarize the result, look at the |collect function.

lpolo
Motivator

It worked. I forgot about _raw.

Thanks.

0 Karma

lpolo
Motivator

I am not sure If I could use transforms.conf to transform an event that is already indexed. I have never done it before.

I have used transform.conf to transform an event that is going to be indexed for the first time.

Could you provide an example based on above question?

Thanks,
Lp

0 Karma

krugger
Communicator

Don't quite understand the problem. Splunk will generate a table and each column has a name.

So you getting:


result
{"TimeStamp":"1364556697.631","id":"58b6bf4d-948b-416b-8d17-cedcbc1059ec","response":{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }}

You seem to be getting exactly what you are looking for.

If you want to index it, you should consider using a transform to extract the fields.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...