All Apps and Add-ons

In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

prateedshetty
Path Finder

Also if the company name were 'Company=Apple+Banana', how can I ignore the + to make the Company name look like Apple Banana once added in the dashboard.

Final Result should be:
Company
A&B Example
Apple Banana

How I see it now
Company
A
Apple+Banana

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

View solution in original post

0 Karma

prateedshetty
Path Finder

This worked

sourcetype=abc| rex field=Company mode=sed "y/+/ /" |stats count by Company

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

View solution in original post

0 Karma

prateedshetty
Path Finder

I just tried the below query to replace + with space.

sourcetype=abc "https://www.abc.com" | rex field=Company mode=sed "s/+/ /g" | Top Company

and I get --> Error in 'rex' command: Regex: quantifier does not follow a repeatable item

0 Karma

prateedshetty
Path Finder

This just worked though..

............| rex field=Company mode=sed "y/+/ /" |.......

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Good. glad you got it handled.

If that's all you needed, then please accept the answer so the question will show as closed.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!