Getting Data In

Multiple fields extraction

prakashraja1999
Loves-to-Learn Everything

.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex max_match=0 "(?<name>\w+):(?<value>.+?)(?=\s+\w+:|$)"

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This gives you two multi-value fields for the names and the values - if you want corresponding fields created for these, you could do something like this

| rex max_match=0 "(?<_name>\w+):(?<_value>.+?)(?=\s+\w+:|$)"
| streamstats count as _event 
| eval index=mvrange(0,mvcount(_name))
| mvexpand index
| eval _name=mvindex(_name,index)
| eval _value=mvindex(_value,index)
| eval {_name}=_value
| fields - _name _value index
| stats values(*) as * by _event
| fields - _event

Note that extract might not work depending on the consistency of pair delimiters and their inclusion in the value strings.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here are two ideas:  rex command and extract command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The question asked for ideas, not for someone else to do the work.  😀  Did you at least look at the commands?

@ITWhisperer has shown the rex command.  Here is extract:

| extract pairdelim=" " kvdelim=":"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

prakashraja1999
Loves-to-Learn Everything

Kindly share the rex and extract commands

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...