topic Re: Replacing carriage return with special character in Splunk Search

Replacing carriage return with special character

ajdyer2000 — Wed, 30 Nov 2016 23:34:27 GMT

Hi,

Results of a search returns computer name and IPaddress separated by a carriage return

ComputerName [carriage return] ip Adress

I would like to separate them into 2 separate fields

Computername Ipaddresss

Replace

Re: Replacing carriage return with special character

gokadroid — Thu, 01 Dec 2016 00:41:50 GMT

Can you please paste the exact events?

Re: Replacing carriage return with special character

sundareshr — Thu, 01 Dec 2016 01:53:18 GMT

Try this, assuming the field is called src

... | rex field=src "(?<ComputerName>[^\n]+)\n(?<IP>.*)" | table ComputerName IP

Re: Replacing carriage return with special character

niketn — Thu, 01 Dec 2016 03:35:33 GMT

Assuming Field is the field extracted by your search which contains both ComputerName and IPAddress values separated by newline character. You can use replace command to add your own delimeter (in the following example \n is replaced with #. Finally you can use split and mvindex command to read the two fields as needed.

<Your base Search> | eval Field= replace (Field,"\n","#") | eval Fields=split(Field,"#")| eval ComputerName=mvindex(Fields,0) | eval IPAddress=mvindex(Fields,1) | table Field ComputerName IPAddress

Re: Replacing carriage return with special character

ajdyer2000 — Thu, 01 Dec 2016 15:05:44 GMT

Hi,

I don't think I explained it the right way

I only have one field = Computer

Under Computer I have computer names and IP addresses

Computer1 [Carriage Return] 172.34.102.11
Computer2 [Carriage Return] 172.34.102.33
Computer3 [Carriage Return] 172.34.102.45
Computer4 [Carriage Return] 172.34.102.78
Computer5 [Carriage Return] 172.34.102.90

Need to create another field Called IP addresses

So now there will be 2 fields

Computer IPAddress

Computer1 172.34.102.11
Computer2 172.34.102.33
Computer3 172.34.102.45
Computer4 172.34.102.78
Computer5 172.34.102.90

So now there will be 2 fields
Computer

Re: Replacing carriage return with special character

aaraneta_splunk — Tue, 06 Dec 2016 23:40:06 GMT

Hi @ajdyer200 - I received a notification that you accepted sundareshr's answer but here it is unaccepted. Did you accidentally unaccept the answer? Or did the answer not provide the solution you were looking for? If it's the latter, please leave a comment for sundareshr for additional feedback.

Re: Replacing carriage return with special character

niketn — Wed, 07 Dec 2016 04:11:52 GMT

Can you add a screenshot of your Computer field. Seems like you have a multi-valued field where you can use all the even indexes for Computer and odd indexes for IP Addresses i.e.

eval Computer1=mvindex(Computer,0) | eval IPAddress1=mvindex(Computer,1) | eval Computer1=mvindex(Computer,2) | eval IPAddress1=mvindex(Computer,3) | ...

Please let me know whether you want to do something like above, then you can use foreach to iterate through your records.

Also if the field is formed as multi-valued by your search query, you can also try to see if there is a feasibility to split them upfront rather than using mv commands.