topic Values with Pipe as String in Splunk Search

Values with Pipe as String

andimak — Fri, 16 Jun 2017 07:45:44 GMT

Hi,

I have events which look like that:
a=test1 b=test2 func=test3|test4|test5
and
a=test1 b=test2 func=test5

if a make a search on func i get results like test3 or test5, but i want "test3|test4|test5" and test5 as result.
I tried to extract a new Field but its not working like i want it. It doesnt work with a delimiter space cause i will get the other key=value pairs too in this extracted field. And I dont really know how to make the regex extracted field to do this.

regards

Re: Values with Pipe as String

DalJeanis — Fri, 16 Jun 2017 12:01:53 GMT

In a search pipeline, you can do this to turn those three values into single values in a multivalue field...

| makemv delim="|" func

Hmmm. The pipes should not interfere with a normal extraction or a normal search.

Just be aware that with any command using regular expressions (regex, match, etc) you will need to escape the pipe character, or it will be interpreted as "OR".