topic How to split a string into multiple fields for different domains in Splunk Search

How to split a string into multiple fields for different domains

pavan_bhumanapa — Mon, 28 Sep 2020 17:14:59 GMT

We have a scenario where we have many domains and we want to split it accordingly . Any advice would be great help .

test_corp1_osb_tid
-> product: osb
-> environment: tid
-> region: test
-> segment: corp

proc_osb_tid
-> product: osb
-> environment: tid
-> region: us
-> segment: proc

cvs_bpel_tid
-> product: bpel
-> environment: tid
-> region: us
-> segment: cvs

Re: How to split a string into multiple fields for different domains

martin_mueller — Sat, 02 Aug 2014 00:23:44 GMT

Are you looking for a rex call? Your question isn't really clear on that.

... | rex field=domain "^(?:(?<region>[^_]+)_)?(?<segment>[^_]+)_(?<product>[^_]+)_(?<environment>[^_]+)$" | eval region = coalesce(region, "us") | ...

Re: How to split a string into multiple fields for different domains

pavan_bhumanapa — Mon, 04 Aug 2014 14:54:19 GMT

Do we have any other solution apart from regex? like lookups. I need to pull the values from log and split the string.

EX:

<Jul 25, 2014 9:51:25 AM MYT> <Error> <WliSbCustomResources> <aussoaditapp12.us.dell.com> <apj_corp1_osb_dit_ms2>

Re: How to split a string into multiple fields for different domains

martin_mueller — Mon, 04 Aug 2014 21:08:17 GMT

Regex are the way to go for extracting parts of a string.

Lookups add fields to an event based on some matching fields, similar to an SQL join.

Re: How to split a string into multiple fields for different domains

pavan_bhumanapa — Tue, 26 Aug 2014 21:14:19 GMT

I am able to extract these fields using lookup.