I am capturing some machine data and am wondering if it is possible to grab more or fewer fields via field extraction based on a size field in the data itself?
1480823739.999999 bus device [6] aa bb ff 00 33 33
1480823741.999999 bus device [2] ab f0
with the [6] and [2] in the data being the size values respectively.
My present field extraction regex looks like this:
^\s+\(\d+\.\d+\)\s+(?P<bus>\w{1,4})\s+(?P<device>\w{2,3})\s+\[(?P<data_len>\d)\]\s+
This gets me extracted up to the message bytes. While I can just import the data values as a single field, I would like to be able to pull each two hex characters into separate fields based on this size data.
Expanding on my regex, if I add multiple byte extractions to cover all instances, the smaller messages will not be extracted.
^\s+\(\d+\.\d+\)\s+(?P<bus>\w{1,4})\s+(?P<device>\w{2,3})\s+\[(?P<data_len>\d)\]\s+(?P<byte0>\w[0-9A-F]+)\s+(?P<byte1>\w[0-9A-F]+)\s+(?P<byte2...
This results in the 6 byte messages being trapped and none of the smaller messages will.
Can I have Splunk create multiple >byte1<,>byte2<,>byteN<... extractions based on the >data_len< field?
Thank you,
Wilsonite
... View more