All Apps and Add-ons
Highlighted

In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

Path Finder

Also if the company name were 'Company=Apple+Banana', how can I ignore the + to make the Company name look like Apple Banana once added in the dashboard.

Final Result should be:
Company
A&B Example
Apple Banana

How I see it now
Company
A
Apple+Banana

0 Karma
Highlighted

Re: In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

SplunkTrust
SplunkTrust

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

View solution in original post

0 Karma
Highlighted

Re: In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

Path Finder

I just tried the below query to replace + with space.

sourcetype=abc "https://www.abc.com" | rex field=Company mode=sed "s/+/ /g" | Top Company

and I get --> Error in 'rex' command: Regex: quantifier does not follow a repeatable item

0 Karma
Highlighted

Re: In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

Path Finder

This just worked though..

............| rex field=Company mode=sed "y/+/ /" |.......

0 Karma
Highlighted

Re: In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

SplunkTrust
SplunkTrust

Good. glad you got it handled.

If that's all you needed, then please accept the answer so the question will show as closed.

0 Karma
Highlighted

Re: In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

Path Finder

This worked

sourcetype=abc| rex field=Company mode=sed "y/+/ /" |stats count by Company

0 Karma