topic Re: How to extract pipe separated subfields from a field? in Splunk Search

How to extract pipe separated subfields from a field?

lewix — Wed, 22 Oct 2014 11:17:35 GMT

Hi,
I have a index with a field named PARAMS.
This field has a content valued by subfields pipe separated.

Example:
PARAMS= mySubField1|mySubField2|mysubField3|......|mySubFieldN

Unfortunately Splunk doesn't correctly index this field (PARAMS) but in search app shows only the first subfield (mySubField1).
Even if i try to search other subfields (mySubField2, mySubField3, etc) Splunk return nothing.

Example:
_raw = PARAMS= mySubField1|mySubField2|mysubField3|......|mySubFieldN
but Splunk only shows mySubField1
event if i try in search PARAMS=mySubField2 Splunk returns nothing.

Anybody can help me please or suggest me a workaround?

Thank you!
Lewix

Re: How to extract pipe separated subfields from a field?

sowings — Wed, 22 Oct 2014 22:27:26 GMT

You can create a DELIMS based extraction (transforms.conf) to extract the subfields:

[your\_transform\_rule]
SOURCE\_KEY = PARAMS
DELIMS = "|"
FIELDS = mysubfield1, mysubfield2, ..., mysubfieldN

Then, you'd call that rule from the props of your sourcetype, like this:

[your\_sourcetype]
REPORT-subfields = your\_transform\_rule

Re: How to extract pipe separated subfields from a field?

lewix — Mon, 28 Sep 2020 18:01:36 GMT

Hi,
thank you for your help but it seems not working.

I show you what i did, maybe something is wrong

In /opt/splunk/etc/apps/dbx/default/transforms.conf I added these lines
[ethconnector_rule] SOURCE_KEY = PARAMS DELIMS = "|" FIELDS = PARAMS_FIELD1,PARAMS_FIELD2,PARAMS_FIELD3,PARAMS_FIELD4,PARAMS_FIELD5,PARAMS_FIELD6,PARAMS_FIELD7,PARAMS_FIELD8,PARAMS_FIELD9,PARAMS_FIELD10,PARAMS_FIELD11,PARAMS_FIELD12,PARAMS_FIELD13
In /opt/splunk/etc/apps/dbx/default/props.conf I added these lines (buonopasto is my database-input sourcetype)

[buonopasto] REPORT-subfields = ethconnector_rule

I restarted splunk but new fields (PARAMS_FIELD1,...., PARAMS_FIELD12,PARAMS_FIELD13) do not appear in splunk search

Last info: PARAMS, as I said before, is pipe separated in subfields, but not always. There is another field that determines how PARAMS is separated.
Example:
if CMD==puttrans then PARAMS=PARAMS_FIELD1|...|PARAMS_FIELD12|PARAMS_FIELD13
if CMD==noop then PARAMS=field1 field2 field3

Maybe can this be the issue?

Thank you again.
Lewix

Re: How to extract pipe separated subfields from a field?

marcoscala — Mon, 01 Dec 2014 10:30:50 GMT

Hi,
I suggest you to check this document section:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Parsemultivaluefields

As you can see, I think that one simple solution could be to use "makemv" command, like this:

sourcetype=buonopasto  CMD=noop| makemv delim="|" PARAMS

that works in the simple scenario where you just have one separator (the PIPE char). It this works for you at least in that case, you can then work on a "append" of two searches, like this:

sourcetype=buonopasto  CMD=noop| makemv delim="|" PARAMS | append [search sourcetype=buonopasto  CMD=puttrans| makemv delim=" " PARAMS ]

Hope it helps,

Marco