How to organize values in Statistics search?

ecm9210 — Tue, 29 Sep 2020 14:00:00 GMT

Hi, I have a blob of text in both the title and description file, I've tried looking for how to seperate them when I am seraching but I have not found anything. It looks like

Question? NoIf yes, Question? N/ADoes this even do something? N/AIs the event a false positive? YesTicket number: N/ASource Unique Identifier (UI): Alert trigger time: Date/time UTCEvent start time: Date/time

etc

I would like it to look like this
Question? No
If yes, Question? N/A
Does this even do something? N/A
Is the event a false positive? Yes
Ticket number: N/A
Source Unique Identifier (UI):

Alert trigger time: Date/time UTC
Event start time: Date/time

The search I'm using is this

| inputlookup append=t investigative_canvas_entries_lookup
| table _time creator owner title description canvas_id
| sort -_time

Re: How to organize values in Statistics search?

DalJeanis — Tue, 09 May 2017 21:05:49 GMT

First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.

If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....

...if you want the questions and answers each separate...

| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"

...if you want each question and answer as a unit ...

| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"

topic Re: How to organize values in Statistics search? in Splunk Search

How to organize values in Statistics search?

Re: How to organize values in Statistics search?