Splunk Search

Field extraction in cab

lohit
Path Finder

I have a csv file with following format:

105723,1614:79660877,United States,Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36,,2013-08-06 07:09:49.100000000,92253497

I have done the field extraction on this file delimiting on a comma(,). The problem I am facing is that one of the fields has a comma embedded in it because of which the entries are coming under different column names. Also, this type of log format is not the same in all rows of the csv file. How can I eliminate either (abcd ,efgh), i.e., whole value including the parenthesis or can I ignore the comma between the parenthesis.

Tags (2)
0 Karma

lohit
Path Finder

@davecroto,kristian

I wanted to say that not in all rows(abcd,efgh) is coming. Sure entries are coming but in some fields delimeted by (;) like (abcd;efgh). I know it is a bad file genrated but this is all i have.

0 Karma

kristian_kolb
Ultra Champion

not all user-agent strings contain commas.

0 Karma

davecroto
Splunk Employee
Splunk Employee

Also, this type of log format is not the same in all rows

Not sure what you mean here. Do you mean the (abcd,efgh) is not always in the same column?

0 Karma

kristian_kolb
Ultra Champion

One way to do it would be to use SEDCMD in props.conf, by which you could remove anything within parentheses, if there is a comma there.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Not able to test it at the moment, but something like this ought to work as a starting point;

props.conf (on your indexer, or wherever the parsing phase takes place)

[your_sourcetype]
SEDCMD-drop_bad_comma = s/\s\([^\),]+,[^\)]+\)\s/ /g

Hope this helps,

K

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...