All Apps and Add-ons

Need to split string with variable number of fields

jagdeepgupta813
Explorer

Hi ,

I have a string like this "details=[ A_0B_0N_0Z_0AB_0AU_0CA_0]^"
I need to split the above string by '_' where left side would be a field name and right would be a value. Final requirement is to display all the fileds which has value =10 .
Note: The string might have one or many such field/value combination

Thanks in Advance.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults
| eval _raw="details=[ A_0B_0N_0Z_0AB_0AU_0CA_0]^"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex max_match=0 mode=sed "s/([^_]+)_(\d+)/\1=\2,/g"
| kv
0 Karma

niketn
Legend

@jagdeepgupta813, following is a run any where search based on the data provided. First two pipes here are to mock up provided data. Please try out and confirm if this is what you are looking for.

|  makeresults
|  eval _raw="details=[ A_10B_20N_30Z_40AB_50AU_60CA_70]^"
|  rex field=_raw "details=\[\s(?<details>[^\]]+)\]\^"
|  rex field=details "(?<field>[^_]+)?_(?<value>\d+)" max_match=0
|  eval details=mvzip(field,value)
|  table details
|  mvexpand details
|  eval details=split(details,",")
|  eval field=mvindex(details,0)
|  eval value=mvindex(details,1)
|  fields - details

PS: Since in the data example details is a key value pair i.e. "details=", if details field is available during search time you will also not need first rex on your _raw data. You would need to confirm this as this could boost search performance.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ddrillic
Ultra Champion

Do you mean that the fields/values in the example are - A=0, B=0, N=0, Z=0, etc.?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...