topic Re: Searches separated by Colon in Splunk Search

Searches separated by Colon

ekucevic — Tue, 06 Jul 2021 16:02:28 GMT

I source database that displays all of the info i need that is separated by colon. Example "ilruPartNumber":"12345"., "lruSoftwareVersion":"7.10.0.74". All of the info i need is separated by an " : "

What i want is to separate the search to list the Name then Number. Example ilruPartNumber = 12345.

Re: Searches separated by Colon

ITWhisperer — Tue, 06 Jul 2021 16:11:53 GMT

| rex "\"(?<key>[^\"]+)\":\"(?<value>[^\"]+)\"" | eval {key}=value

Re: Searches separated by Colon

ekucevic — Tue, 06 Jul 2021 21:11:35 GMT

I am a beginner here so alittle bit of a walk through could be necessary.

Re: Searches separated by Colon

ITWhisperer — Tue, 06 Jul 2021 22:13:42 GMT

The rex command (without a field argument) will operate on the _raw field of each event. The regex used extracts the part before the colon into a field called key and the part afterwards into a field called value. The eval command creates a field using the name in the key field and with the value from the value field. This is the basis for extracting the field. If you want a more precise version of the command, you should share some anonymised events, that you have already retrieved with your search, so the command can be tailored to your specific case.

Re: Searches separated by Colon

ekucevic — Thu, 08 Jul 2021 16:41:08 GMT

Hi, Thanks for your reply, I think my issue is due to quotes within quotes? No sure. Below is a sample of my search. Basically everything in red is a sample what i am searching for.

[{"lruName":"Modem","lruType":"MBR","lruMacAddress":"00:A0:BC:72:6F:44","lruModelNumber":"MBR-5500","lruSerialNumber":"C80016506037","lruPartNumber":"1244523","lruSoftwareVersion":"M3-1.3.5.2.89_2021.06.18","lruConfigVersion":"7.10.0.38"

Re: Searches separated by Colon

ITWhisperer — Thu, 08 Jul 2021 18:01:35 GMT

This looks like JSON, perhaps you should investigate spath as a way to extract the fields