topic Re: How do I extract a comma separated field during search? in Splunk Search

How do I extract a comma separated field during search?

andyk — Thu, 14 Feb 2013 14:50:40 GMT

I have event data in Splunk that look like this:

2013-02-14 11:32:46.4314 app=ws3 sev=INFO mid=1325748 , Fooo, Barr, , 7 rue de fuubarr, , 44540, xx zzz la yyyyy, , FR, ENG, , 1031, EUR,,,

I need to do an Ad Hoc report that count the events grouped by country. The country information is in the filed that contains "FR" in this example event.

Re: How do I extract a comma separated field during search?

jeff — Thu, 14 Feb 2013 16:02:02 GMT

Assuming all of your data has the same format:

{ search criteria } 
| rex field=_raw "^([^,]+,){9} +(?<country>[^,]+)"

Re: How do I extract a comma separated field during search?

Rob — Thu, 14 Feb 2013 16:34:15 GMT

Nicely done!

Re: How do I extract a comma separated field during search?

andyk — Fri, 15 Feb 2013 08:05:40 GMT

Works perfect! Thanks!

Re: How do I extract a comma separated field during search?

rsantkumar — Wed, 20 May 2020 09:42:56 GMT

hi @jeff @andyk : I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon).

Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;

I am trying to extract the 3 fields and display as a table in splunk. Please help.

Re: How do I extract a comma separated field during search?

rsantkumar — Wed, 20 May 2020 09:43:23 GMT

hi @jeff @andyk @Rob : I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon).

Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;

I am trying to extract the 3 fields and display as a table in splunk. Please help.