topic How do I split _raw data into multiple table fields? in Splunk Search

How do I split _raw data into multiple table fields?

slord — Wed, 22 Aug 2018 17:05:25 GMT

I have the following data in _raw and I need to split the data at the semicolon into multiple fields in a table

LOG INPUT (_raw)

2018-08-22 10:45:19,834 ;Application 1;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:44:19,834 ;Application 2;Status Unknown;SEARCH_STRING;APP_STATUS
2018-08-22 10:43:19,834 ;Application 4;Status Offline;SEARCH_STRING;APP_STATUS
2018-08-22 10:42:19,834 ;Application 5;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:41:19,834 ;Application 3;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:40:19,834 ;Application 1;Status Offline;SEARCH_STRING;APP_STATUS

I want a table that looks like

Date                     | Application Name  | Status         | Search        | Ingore
2018-08-22 10:45:19,834  | Application 1     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:44:19,834  | Application 2     | Status Unknown | SEARCH_STRING | APP_STATUS
2018-08-22 10:43:19,834  | Application 4     | Status Offline | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 5     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 3     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:41:19,834  | Application 1     | Status Offline | SEARCH_STRING | APP_STATUS

Re: How do I split _raw data into multiple table fields?

richgalloway — Wed, 22 Aug 2018 17:59:11 GMT

Use the rex command.

index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...

Re: How do I split _raw data into multiple table fields?

horsefez — Wed, 22 Aug 2018 18:23:45 GMT

Hi @slord,

you should rather go for the field extractor tool in splunk to extract out the fields you want. You do have an option to choose "delimiter" ";" as an option there.

Re: How do I split _raw data into multiple table fields?

slord — Thu, 23 Aug 2018 13:46:51 GMT

You are awesome, that worked ... thanks!

Re: How do I split _raw data into multiple table fields?

richgalloway — Fri, 24 Aug 2018 18:45:46 GMT

@slord, if your problem is resolved, please accept an answer to help future readers.