topic Re: How to extract a csv data fields message data into fields? in Splunk Search

How to extract a csv data fields message data into fields?

Cheng2Ready — Fri, 02 Aug 2024 23:11:46 GMT

I have a field message that when
I run the search

index=example123 host=5566 |search "*specials word*" I table message

it displays as an example below:

2024-08-02 16:45:21- INFO Example (['test1' , 'test2', 'test3', 'test4', 'test5', 'test6', 'test7)'] , ['Medium', 'Large ', 'Small', 'Small ', 'Large ', 'Large ', 'Large '])

Is there a way to run a command so that the data in the field "Message" can be extracted into their own fields or displayed like this matching 1:1 on a table

test1 test2 test3 test4 test5 test6 test7
Medium Large Small Small Large Large Large

or

test1 = Medium
test2= Large
test3 = Small
.... ect

Re: How to extract a csv data fields message data into fields?

ITWhisperer — Fri, 02 Aug 2024 18:40:29 GMT

Assuming your real events don't have brackets in the names, try something like this

| rex "Example \(\[(?<keys>[^\]]*)\]\s*,\s*\[(?<values>[^\]]*)\]\)" | rex max_match=0 field=keys "'(?<key>[^']+)'" | rex max_match=0 field=values "'(?<value>[^']+)'" | table key value | eval pairs=mvzip(key, value, "=")

Re: How to extract a csv data fields message data into fields?

Cheng2Ready — Fri, 02 Aug 2024 20:11:08 GMT

Thank you for your prompt response
I have different container names
example replacing

'test1' , 'test2', 'test3', 'test4', 'test5', 'test6', 'test7

to as an example

'x99_846' , 'beacon score', 'account count', '', 'credit_transactions', 'status_active_years', 'current'

ect

Re: How to extract a csv data fields message data into fields?

ITWhisperer — Fri, 02 Aug 2024 20:17:36 GMT

Does the search work for you?

Re: How to extract a csv data fields message data into fields?

Cheng2Ready — Fri, 02 Aug 2024 22:00:06 GMT

partially
Where we had "Example"
It can sometimes be other words
so its not capturing everything from ([

Re: How to extract a csv data fields message data into fields?

Cheng2Ready — Fri, 02 Aug 2024 23:49:54 GMT

I think I found the answer
| rex field="Example" seemed to work

Thank you

Re: How to extract a csv data fields message data into fields?

ITWhisperer — Sat, 03 Aug 2024 06:39:19 GMT

It is often quicker if you give accurate representations of your real data, not just made up names, but good that you worked out how to fix it.