Getting Data In
Highlighted

Split not working

New Member

I have following data after this query:

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="SERVICE_PERF"
| table message

|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie1|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|67|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA
|2800|BackOffice|T999999||Servcie2|8b81dbd0-ba0f-11e9-8912-914decccd432|Success|16|NA|NA|NA

I then run the following query:

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="NG_SERVICE_PERFORMANCE"
| table message
| eval fields=split(message,"|") , etime=mvindex(fields,8)
| table etime

It fails.

When I run it with _raw instead of message in split, it works. Why is that so?

I am using logs in JSON format.

Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: Split not working

New Member

Sorry, second query is:
index=sdlocpepo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath
| search level="SERVICE
PERF"
| table message
| eval fields=split(message,"|") , etime=mvindex(fields,8)
| table etime

0 Karma
Highlighted

Re: Split not working

SplunkTrust
SplunkTrust

I am not sure why its not working because the syntax looks perfect. Do you get any error?

Well you could use rex to get the desired result.

index=sdlocp_epo-solutiontest sourcetype="kube:container:customer-soap-app"
| spath 
| search level="SERVICE_PERF" 
| table message 
| rex field=message "\|\w+\|(?<etime>\d+)\|"
| table etime

let me know if this helps!

0 Karma