topic Re: Assign keys to tokenised string in Splunk Search

Assign keys to tokenised string

afulamba — Fri, 17 Aug 2018 05:06:10 GMT

Hi there,
Can someone help me with reading the tokenized string and assign the keys to each index retrieved. It is difficult for me as it is not key/value format to read.

Log sample:
CustomerServicegetPointDetails66860x00000000Successful Response230Louis/ST=Missouri/C=US PRODESB6_STL|18234799|180817043259896SAML00
I know which values is for what field in the sequence they appear in the logs. It does has space as a value too. I did tried below but since there are more than 20 fields I have to extracts, the query becomes very long and ugly and can cause performance too.

index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1) | eval temp=split(tokenString,"") | eval field0=mvindex(temp,0) | eval field1=mvindex(temp,1)
I did check few regex option on web, that was also long query too.

Please advise.

Thanks,

Re: Assign keys to tokenised string

afulamba — Fri, 17 Aug 2018 05:10:58 GMT

sorry for the format of the text it appears. I could not preview it or see the option to edit my post.

Re: Assign keys to tokenised string

niketn — Fri, 17 Aug 2018 06:34:04 GMT

@afulamba use the <code> button on Splunk Answers i.e. 101010 to post your code so that special characters do not escape. You can also select code to highlight and use shortcut Ctrl+G to convert to code (which adds four spaces prior to every line of code)

Re: Assign keys to tokenised string

afulamba — Fri, 17 Aug 2018 07:12:17 GMT

@niketnilay: Thank you! I will take a not of it for my next posts.

Re: Assign keys to tokenised string

afulamba — Fri, 17 Aug 2018 07:15:24 GMT

Reposting sample log and my code
CustomerServicegetPointDetails6686435528520x00000000Successful Response230Louis/ST=Missouri/C=USPRODESB6_STL|18234799|180817043259896SAML00

My code:

index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1)
| eval temp=split(tokenString,"`")
| eval field0=mvindex(temp,0)
| eval field1=mvindex(temp,1)

Re: Assign keys to tokenised string

afulamba — Sat, 18 Aug 2018 02:55:41 GMT

Can someone help me here, please?

Thanks,
Amit