topic Re: Extract multiple name value pairs from a field in Splunk Search

Extract multiple name value pairs from a field

jbax — Tue, 07 Jul 2020 05:34:44 GMT

Hello,

I have a field that contains the string below.

a) There can be fewer/more than the 4 events listed below.

b) Value of the events will be different.

(event=aa)(event=bb)(event=cc)(event=normal)

=====================================================

1) How can I create a new field events that equals "aa,bb,cc,normal"?

2) Is there a way to exclude the normal event? So field events = "aa,bb,cc" only?

3) Is there a way to make it list like so I can filter on these events values? (ie - potentially count # of events with aa or cc or (aa + cc)?)

4) Is there a way to count the events returned in the field?

Thank you!

renjith_nair — Tue, 07 Jul 2020 06:11:44 GMT

Try regex

|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"

From the result, you can do rest of the stats

Sample data

Let's know your final output format. We can fine tune w.r.t count and total

jbax — Wed, 08 Jul 2020 04:09:33 GMT

Thanks, this worked well for me! Would you know of a way to exclude values (ie - normal)?

Thank you!

renjith_nair — Wed, 08 Jul 2020 04:26:37 GMT

Sure. Just add this after the rex command

|eval EVENTS=mvfilter(!match(EVENTS,"normal"))