Getting Data In

Extract a Value from a Field

corydm
New Member

Terminology might be off, but I'll give the exact example:
"The session setup from computer 'NOCSERVER_A123' failed because the security....." and so on. This is a field called "Message" and I would like to assign "NOCSERVER_A123" to it's own field called Hostname. My intention is that when I search, my query returns just the Hostname, and not the entire "Message" field.

I've tried a few different things to no luck, and I believe the problem is I have a very basic grasp on how to achieve this. I would really appreciate if someone could clear up how to do this, and if possible, explain it a little or give me links to some documentation/tutorial pages. I feel like what I've been doing with the transform.conf and props.conf are incorrect.

Thanks!

0 Karma

LukeMurphey
Champion

You do this easily with props and transforms. Your props.conf will look something like this:

[host_from_message]
SOURCE_KEY = Message
REGEX = The session setup from computer '(.+)' failed because the security
FORMAT = hostname::"$1"

With a transforms.conf entry like:

[your_sourcetype]
REPORT-host_from_message = host_from_message

As @Ayn said, check the docs out. They are very helpful.

Ayn
Legend
0 Karma

aholzer
Motivator

Have you tried defining a field extraction with regex?

Something like this might help you:
'(?[^']+)'

This would extract everything between two single quotes, that isn't a single quote into a field called "FIELD_NAME". You may have to escape the single quotes, I'm not 100% sure on that bit.

If your hostname isn't always contained within single quotes then you would have to play around with regex to identify the exact expression in which to extract your hostnames.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...