topic Re: Extracting values inside of a [] , which are , separated with spaces in Splunk Search

Extracting values inside of a [] , which are , separated with spaces

RamMur — Tue, 04 Jun 2024 16:38:50 GMT

trying to use rex to get the contents for the field letterIdAndDeliveryIndicatorMap.

For example, Logged string letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]

I want to extract the contents between the [] , which is abc=P, efg=P, HijKlmno=E and then find stats on them.

I was trying something like

rex field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\] ]+)"

but, its not working as expected.

Thanks in advance!

Re: Extracting values inside of a [] , which are , separated with spaces

ITWhisperer — Tue, 04 Jun 2024 16:58:48 GMT

What do you mean by "not working as expected" (because it looks like you should have extracted something at least)?

Re: Extracting values inside of a [] , which are , separated with spaces

RamMur — Tue, 04 Jun 2024 17:03:59 GMT

yes, found that my regex had a space between ]], once fixed, was able to extract them as "abc=P, efg=P, HijKlmno=E" , thanks. next trying to get stats on count of abc=P.

Re: Extracting values inside of a [] , which are , separated with spaces

dtburrows3 — Tue, 04 Jun 2024 17:43:36 GMT

You should be able to use the split function after extracting which will convert it to a MV field and then utilize a stats against that MV field.
Something like this

<base_search> | rex field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\]]+)" | eval letterIdAry=split(letterIdAry, ","), letterIdAry=case( mvcount(letterIdAry)==1, trim(letterIdAry, " "), mvcount(letterIdAry)>1, mvmap(letterIdAry, trim(letterIdAry, " ")) ) | stats count as event_count by letterIdAry

Example output:

Re: Extracting values inside of a [] , which are , separated with spaces

yuanliu — Tue, 04 Jun 2024 19:00:26 GMT

As @ITWhisperer says, "not working as expected", "doesn't work", etc., should be forbidden in this forum. More specifically, if your raw events contain things like "letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]", Splunk's default extraction should have given you abc, efg, HijKlmlo without you asking. (It also gives you a field letterIdAndDeliveryIndicatorMap.) If you do table *, what do you see?

Here is an emulation

| makeresults | eval _raw="letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]" | extract