topic Re: How to divide a value from a string into fields? in Splunk Search

How to divide a value from a string into fields?

Luninho — Fri, 28 Jan 2022 11:03:17 GMT

I have value in field:

value: 10,5 CC,00136;CY,00004;JE,00004;QK,00004

Where CC,CY,JE - type message and there are more of them than in example

00136,00004 - number of message

But I need to get table:

Type	Count
CC	136
CY	4
JE	4

How can i do it with SPL language?

Re: How to divide a value from a string into fields?

gcusello — Fri, 28 Jan 2022 11:37:22 GMT

Hi @Luninho,

are the types in fixed positions?

if they are in fixed posiztion (e.g. 1st, 3rd 5th position) or identificable e.g. for a newar char (e.g. ; just before), you can create a regex to extract them, otherwise it's very difficoult.

Cold you share some additional samples?

From the one you shared the only rule I can identify is that there's a comma just after, it always has a two upper char.

If this is correct you could creat a regex like this:

| rex "(\s|;)(?<Type>\w\w),"

that you can test at https://regex101.com/r/GuqZpU/1

Ciao.

Giuseppe

Re: How to divide a value from a string into fields?

johnhuang — Fri, 28 Jan 2022 16:17:13 GMT

Assuming the type is always 2 uppercase alphabet characters:

| rex field=value "\s(?<_raw>([A-Z]{2}\,\d{5}\;)+([A-Z]{2}\,\d{5})?)" | extract kvdelim="," pairdelim=";" | transpose | regex column="[A-Z]{2}" | rename column AS Type "row 1" AS count | eval count=tonumber(count) | table Type count

You can substitute with this regex to extract the pattern from your raw data instead of the field value -- test to see which works better.

| rex "\s(?<_raw>([A-Z]{2}\,\d{5}\;)+([A-Z]{2}\,\d{5})?)"