topic Re: Field extraction from data within backslashes in Splunk Search

Field extraction from data within backslashes

mbasharat — Wed, 03 Jun 2020 19:35:33 GMT

Hi,

I have dateset that contains IP addresses. IP Addresses are coming in variations due to ranges they are assigned to separated by \ backslashes. I need them to be extracted in multiple fields regardless of how many variations are there. See sample data below:

1.2.3.4\n4.5.6.7\n8.9.1.2
1.2.3.4\n4.5.6.7\n
1.2.3.4\n4.5.6.7
1.2.3.4\n4.5.6.7\n8.9.1.2

I need them like:
1.2.3.4\n4.5.6.7\n8.9.1.2
Value1: 1.2.3.4
Value2: 4.5.6.7
Value3: 8.9.1.2
Value4: and so on.....

So basically all values within backslash, I need them separated out in fields. Also, the letter "n" or any alphabets attached to any IP also needs to go.

Thanks in-advance!

Re: Field extraction from data within backslashes

richgalloway — Wed, 03 Jun 2020 20:19:44 GMT

The IP addresses are not separated by backslashes, they're separated by newlines (\n). To split them up, use the split command followed by mvexpand. Assuming the addresses are in a field called 'foo', this should do it.

... | eval ips = split(foo, "\n") | mvexpand ips

Re: Field extraction from data within backslashes

to4kawa — Wed, 03 Jun 2020 20:22:46 GMT

| makeresults 
| eval _raw="1.2.3.4\n4.5.6.7\n8.9.1.2
1.2.3.4\n4.5.6.7\n
1.2.3.4\n4.5.6.7
1.2.3.4\n4.5.6.7\n8.9.1.2"
| multikv noheader=t 
| fields _*
| rename COMMENT as "this is sample, check this. from here, the logic"
| rex max_match=0 "(?<data>[\d.]+)"
| streamstats count as session
| mvexpand data
| streamstats count as cols by session
| eval cols="col".cols
| xyseries session cols data

Re: Field extraction from data within backslashes

mbasharat — Thu, 04 Jun 2020 02:35:43 GMT

I used the same eval but with backslash only and it did not work and I have no idea why, added \n instead like yours and worked perfectly. THANKS!!

BTW, do you happen to know the reason why just backslash does not get picked up?

Both yours and @to4kawa solutions work great but rich's solution is less typing :). Accepting RIch's and upvoting t04kawa! 🙂

Thank you both!

Re: Field extraction from data within backslashes

mbasharat — Thu, 04 Jun 2020 02:36:31 GMT

Both yours and Rich's solutions work great but rich's solution is less typing :). Accepting Rich's and upvoting t04kawa! 🙂

Thank you both!

Re: Field extraction from data within backslashes

mbasharat — Wed, 30 Sep 2020 05:37:38 GMT

One more thing to add, below also worked:

| makemv delim="\n" IP_Extracted
| mvexpand IP_Extracted

Re: Field extraction from data within backslashes

richgalloway — Thu, 04 Jun 2020 12:33:11 GMT

Backslash by itself is not picked up because it is the escape character. That means it modifies the character that follows it. To match the literal backslash you must escape it \\\.

Re: Field extraction from data within backslashes

mbasharat — Thu, 04 Jun 2020 13:34:33 GMT

Works. Thanks!!!