topic how to split string in splunk in Splunk Search

how to split string in splunk

Khushboo — Tue, 15 Dec 2020 14:41:15 GMT

Hi @all,

i have following string which i want to break into there fields: service_name, host and port_id

metics-ha-5924590-011.aba.corp.tyos.com:2002

service_name = metics

host = ha-5924590-011.aba.corp.tyos.com

port = 2002
anyone please help me, how can i do it in splunk query.

Thanks !!

gcusello — Tue, 15 Dec 2020 15:03:06 GMT

Please, try this regex:

| rex "(?<service_name>[^-]+)-(?<host>[^:]+):(?<port>\d+)"

Ciao.

Giuseppe

Khushboo — Tue, 15 Dec 2020 15:23:18 GMT

Thanks for your reply.
In my case all the variables like service_name, host and port are dynamic. so i cant hard-coded that.

gcusello — Tue, 15 Dec 2020 15:27:33 GMT

you have to define a rule to extract fields:

if you cadn define that:

this regex can work.

In other words if you can define a rule, you can use a regex otherwise you cannot!

Ciao.

Giuseppe