topic Re: Copy and then parse a field in Splunk Search

Copy and then parse a field

a212830 — Mon, 13 May 2019 20:24:14 GMT

Hi,

I have a field that already exists, and I want to parse it out into a new field, using props/transforms. The field is surrounded in brackets, so it's in this format:

<COMPID> these are some values </COMPID>

The entired feed is bracket enclosed (but not xml). I've never done this before, and the regex is killing me as well. Can anyone help?

Re: Copy and then parse a field

MuS — Mon, 13 May 2019 20:37:28 GMT

Hi a212830,

see this answer https://answers.splunk.com/answers/319646/how-to-write-the-regex-to-extract-data-inside-squa.html
but you will use this settings in transforms.conf :

REGEX = \>([^\<]+)\<
FORMAT = MyNewFieldName::$1

This will create a new field called MyNewFieldName containing this value these are some values.

Hope this helps ...

cheers, MuS

Re: Copy and then parse a field

a212830 — Thu, 06 Jun 2019 15:11:51 GMT

Sorry, getting back to this... not sure this will work, as every field is bracket <> seperated. I need something that will extract the first string within the values. It contains multiple, white space seperated values.

<COMPID>string1 string2 string3 string4</COMPID>

Re: Copy and then parse a field

MuS — Thu, 06 Jun 2019 22:11:09 GMT

Sure this will work, I just did not understood it correct 😉

In this case try this regex:

REGEX = \>([^\s]+)\s

this will get string1 from your example as value of the MyNewFieldName.

cheers, MuS

Re: Copy and then parse a field

sloshburch — Mon, 01 Jul 2019 12:45:42 GMT

Hey @a212830, is this a duplicate post to your Help with props and transforms?