Getting Data In

Multiple fields extraction

prakashraja1999
Loves-to-Learn Everything

.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex max_match=0 "(?<name>\w+):(?<value>.+?)(?=\s+\w+:|$)"

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This gives you two multi-value fields for the names and the values - if you want corresponding fields created for these, you could do something like this

| rex max_match=0 "(?<_name>\w+):(?<_value>.+?)(?=\s+\w+:|$)"
| streamstats count as _event 
| eval index=mvrange(0,mvcount(_name))
| mvexpand index
| eval _name=mvindex(_name,index)
| eval _value=mvindex(_value,index)
| eval {_name}=_value
| fields - _name _value index
| stats values(*) as * by _event
| fields - _event

Note that extract might not work depending on the consistency of pair delimiters and their inclusion in the value strings.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here are two ideas:  rex command and extract command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The question asked for ideas, not for someone else to do the work.  😀  Did you at least look at the commands?

@ITWhisperer has shown the rex command.  Here is extract:

| extract pairdelim=" " kvdelim=":"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

prakashraja1999
Loves-to-Learn Everything

Kindly share the rex and extract commands

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...