topic Re: How do you use rex to extract a specific field in Splunk? in Splunk Search

How do you use rex to extract a specific field in Splunk?

braicu — Tue, 29 Sep 2020 23:48:05 GMT

Hello,

Can anybody help me extracting from this table with 3 regular expression:

I got a column in Splunk like this and the values between

Custom_Tag (this is the column name which i need to be split into 3 columns Account,AssetOwner,AssetDataStored)
"Key": "Account", "Value": "037395386785"
"Key": "AssetOwner", "Value": "Infrastructure"
"Key": "AssetDataStored", "Value": "InternalUseOnly"
"Key": "Account", "Value": "343254354354"
"Key": "AssetOwner", "Value": "Production"
"Key": "AssetDataStored", "Value": "ExternalUse"

and i need a rex to extract the values into 3 columns when matching the word Account,AssetOwner,AssedDataStored

Tag_Account Tag_AssetOwner Tag_AssetDataStored
037395386785 Infrastructure InternalUseOnly
343254354354 Production ExternalUse

Re: How do you use rex to extract a specific field in Splunk?

FrankVl — Fri, 22 Mar 2019 15:55:34 GMT

Something like this should work:

| rex field=Custom_Tag "\"Account\",\s+\"Value\":\s+\"(?<Tag_Account>[^\"]+)"
| rex field=Custom_Tag "\"AssetOwner\",\s+\"Value\":\s+\"(?<Tag_AssetOwner>[^\"]+)"
| rex field=Custom_Tag "\"AssetDataStored\",\s+\"Value\":\s+\"(?<Tag_AssetDataStored>[^\"]+)"

Re: How do you use rex to extract a specific field in Splunk?

vnravikumar — Fri, 22 Mar 2019 18:19:09 GMT

Give a try

| makeresults 
| eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"037395386785\"" 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Infrastructure\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"InternalUseOnly\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"343254354354\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Production\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"ExternalUse\""] 
| eval temp = replace(Custom_Tag , "\"|:|Key|Value","") 
| makemv delim="," temp 
| eval column1 = ltrim(mvindex(temp,0)) 
| eval column2=ltrim(mvindex(temp,1)) 
| eval{column1}=column2 
| stats list(Account) as Tag_Account,list(AssetDataStored) as Tag_AssetDataStored,list(AssetOwner) as Tag_AssetOwner