topic Re: Extract field from table data which present on _raw in Splunk Search

Extract field from table data which present on _raw

sathim471 — Sat, 17 Oct 2020 19:56:07 GMT

Hi All,

I have below table type data in _raw and i want to extract fields.

Example _raw as below

Name ID Age

Harry AAA 23

Will BBB 27

Brian CCC 30

Expectation is like below. I want 3 fields (as no.of columns) and it should list like below.

if i do (...|table Name,ID,Age) it should show like below

Name ID Age

Harry AAA 23

Will BBB 27

Brian CCC 30

Thanks in advance

Re: Extract field from table data which present on _raw

inventsekar — Sat, 17 Oct 2020 21:10:43 GMT

Hi @sathim471 .. these logs are already ingested or not yet? if they are ingested already, what is your current search query? the fields may be already extracted..

if so, ..lets say, for example:

index=main source=testSource | table Name ID Age

if fields are not extracted, then, you have to use "rex" (regular expressions)command to extract them. provide us some sample events, so that we can help you with rex query.

Re: Extract field from table data which present on _raw

to4kawa — Sat, 17 Oct 2020 21:56:48 GMT

index=_internal | head 1 | fields _raw | eval _raw="Name ID Age Harry AAA 23 Will BBB 27 Brian CCC 30" | rename COMMENT as "these are your log sample. from here, the logic" | rex mode=sed "s/[ ]+/,/g" | multikv | rename COMMENT as "as you like | table Name,ID,Age"