Getting Data In

How to extract a key and value from the Raw data?

Stevelim
Communicator

While I understand the regex command and click based extraction of data fields. How do I extract both of them via the raw data?

For example:

$ABCD,,Speed,Nmea,63*33

From these, I will like to have a key Speed = 64 for example. I am guessing I need to perform some regex at the transforms.conf. But I am not exactly sure how to start.

0 Karma

woodcock
Esteemed Legend

In transforms.conf:

Using FORMAT:

REGEX = (?:[^,]*,){2}([^,]+),[^,]*,([^,]+)
FORMAT = $1::$2

Not using FORMAT:

REGEX = (?:[^,]*,){2}(?<_KEY_1>[^,]+),[^,]*,(?<_VAL_1>[^,]+)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...