topic Re: splitting and inverting in Splunk Search

splitting and inverting

jamesrender — Thu, 26 Oct 2017 14:33:22 GMT

How do I go from:

”metrics=[a=1,b=2,c=3]”
”metrics=[a=2,b=5,c=6]”
”metrics=[a=1,c=3,c=4]”

To:

“a,b,c”
“1,2,3”
“2,5,6”
“1,3,4”

There are a lot more key, value pairs in here, so I don't want to rex them out manually
extract didn't work I'm using a remotesyslog streaming mechanism (no props.conf, transform.conf)
Splitting by comma gave me a multivalue field, I couldn't manage to get much further - I wanted a foreach value

thanks

Re: splitting and inverting

richgalloway — Thu, 26 Oct 2017 14:57:22 GMT

You don't need a transform to use extract. Try this:

... | extract kvdelim="=" pairdelim=","

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 15:02:00 GMT

What is the expected output from doing this?

I'd think new fields:
a=1
b=2
c=3

I don't see any effect of adding this to the query, no new fields 😞
I've used fieldsummary to see..

extract kvdelim="=" pairdelim=", " | fieldsummary

Re: splitting and inverting

richgalloway — Thu, 26 Oct 2017 15:24:06 GMT

Try this run-anywhere example. I get separate fields with it.

| makeresults 
| eval _raw= "metrics=[a=1,b=2,c=3]" 
| extract kvdelim="=" pairdelim=",]"

Re: splitting and inverting

gcusello — Thu, 26 Oct 2017 15:32:44 GMT

Hi jamesrender,
usually Splunk recognize fields when they are in format field=value, so with a simple table command you can have the requested table:

yoursearch
| table a b c

Bye.
Giuseppe

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 15:59:24 GMT

Yes, that works nicely!
wth, I wonder what gives with my real world corporate data version.
This has helped reassure me that extract does work!

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 16:01:05 GMT

what is the field that extract is working on? I've done a rex to generate a field thats in the metrics=[a=1,b=2,c=3] format

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 16:07:32 GMT

ok, by redirecting my rex'd out field to _raw and THEN running kvdelim, I've got all the fields exposed

| rex field=message "msg=\[\{(?<metrics_detail>.*?)\}\]" | eval _raw=metrics_detail | extract kvdelim="=" pairdelim=","

how do I dump them to a table without explicity doing table a b c as there are 20 or more fields

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 16:09:39 GMT

I've gotten extract working when I redirect my rex'd field to _raw like so:

| rex field=message "msg=\[\{(?<metrics_detail>.*?)\}\]" | eval _raw=metrics_detail | extract kvdelim="=" pairdelim=","

So now I've a ton of fields, is there a short way to dump a lot of fields out other than explicitly doing table a b c

Re: splitting and inverting

jamesrender — Thu, 26 Oct 2017 16:12:47 GMT

richgalloway helped me to troubleshoot extract command which ultimately makes this problem much easier to deal with

Re: splitting and inverting

elliotproebstel — Thu, 26 Oct 2017 16:12:50 GMT

You can do |stats values(*) AS * to display the contents of all non-internal fields.

Re: splitting and inverting

richgalloway — Thu, 26 Oct 2017 16:26:46 GMT

You can use | fields - _* | table * to display all non-internal fields.

Re: splitting and inverting

jamesrender — Mon, 30 Oct 2017 16:25:34 GMT

thanks , helped a lot