Splunk Search

field extraction help

getmesomedata
Explorer

I'm fairly new to Splunk so forgive me if I'm asking the obvious.

I'm creating an app for my RabbitMQ server and I'm having a few issues with one of my field extractions. I've got a script

C:\windows\system32>"C:\Program Files (x86)\RabbitMQ Server\rabbitmq_server-3.0.4\sbin\rabbitmqctl.bat" list_queues 

which outputs the following:

Listing queues ...
firstQueue  10
secondQueue 10
whatever    20
...done. 

I can write a field extraction to pull out the queue names and the values one by one but I want it to be more dynamic as the number of queues might change over time. So the next time the script runs it might list out 4 entries and so on.

Can anyone advice me on setup my field extractions so it dynamically pulls out the queue names and count values.

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

I am not familiar with rabbitMQ and that bat file you are calling. Do you have the ability to modify the output any? If you could get it to output as key value pairs like
firstQueue=10
secondQueue=10

Then Splunk will auto extract all key value pairs on it's own without much coaxing. And that would let you not worry about the dynamic number of queues that might come out.

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

I am not familiar with rabbitMQ and that bat file you are calling. Do you have the ability to modify the output any? If you could get it to output as key value pairs like
firstQueue=10
secondQueue=10

Then Splunk will auto extract all key value pairs on it's own without much coaxing. And that would let you not worry about the dynamic number of queues that might come out.

0 Karma

getmesomedata
Explorer

Thanks, this worked a treat

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...