Splunk Enterprise

Unable to extract fields from Mysql column via Regex

Loves-to-Learn Lots

Hi All,

I am working on dbconnect.(MYSQL Connection)

I have a table in which there is column as below:-

DummyValue Host= dummyhost123 |User= dummyuser


I need to extract the values contained in the above column and add it to 3 columns

Column1  : DummyValue

Column2:  dummyhost123

Column 3: dummyuser

Please Help.

NOTE- I have tried using REGEXP_SUBSTR but it was showing error:-REGEXP_SUBSTR is not recognised as built in function name




Labels (2)
Tags (1)
0 Karma

| makeresults 
| eval _raw="DATA
DummyValue Host= dummyhost123 |User= dummyuser"
| multikv forceheader=1 | rex field=DATA "(?ms)(?<col1>\S+)\s\S+ (?<col2>\S+) \S+\s(?<col3>\S+)"

Loves-to-Learn Lots

Hi ,

Thank you for the response. 

I am looking for a way  via sql query  so that once we have the data in splunk it is in appropiate form.

IS there a way in which this can be extracted while creating inputs in db connect ??

0 Karma