topic Re: Parsing comma separated values in Getting Data In

Parsing comma separated values

danurag — Wed, 04 Jan 2012 22:52:04 GMT

I have a script that outputs data in the following format. The problem is that the value of the Error field gets initialized to "No" and ignores the Error part. Also, the Error field could have have a completed stack trace and flow into multiple lines. How do I write the transforms stanza so that it assigns all the values to the "Error" field.

ElapsedTime=2.2812208, StatusCode=OK, ContentMatched=False, Error=No Error

Thank you

Re: Parsing comma separated values

MuS — Thu, 05 Jan 2012 10:13:30 GMT

Hi danurag

you can use a regex like this ([^=]*)$ to match everything after the last = to be extracted

cheers

Re: Parsing comma separated values

danurag — Thu, 05 Jan 2012 16:54:24 GMT

Hi MuS, I need help with writing the complete regex. Could you please give me some pointers.

Thanks.

Re: Parsing comma separated values

yannK — Thu, 05 Jan 2012 18:33:45 GMT

try the inline regex,
mysearch | rex field=hop "Error=(?<Error>([^=]*)$)" | table Error
then once confirmed working, you can define an automatic field extraction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Knowledge/Managesearch-timefieldextractions