Assign keys to tokenised string

[afulamba]

Hi there,
Can someone help me with reading the tokenized string and assign the keys to each index retrieved. It is difficult for me as it is not key/value format to read.

Log sample:

CustomerServicegetPointDetails66860x00000000Successful Response230Louis/ST=Missouri/C=US PRODESB6_STL|18234799|180817043259896SAML00

I know which values is for what field in the sequence they appear in the logs. It does has space as a value too. I did tried below but since there are more than 20 fields I have to extracts, the query becomes very long and ugly and can cause performance too.


index=app sourcetype = audit

| eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1)
| eval temp=split(tokenString,"")
| eval field0=mvindex(temp,0)
| eval field1=mvindex(temp,1)


I did check few regex option on web, that was also long query too.

Please advise.

Thanks,

[afulamba]

Can someone help me here, please?

Thanks,
Amit

[afulamba]

Reposting sample log and my code

CustomerServicegetPointDetails6686435528520x00000000Successful Response230Louis/ST=Missouri/C=USPRODESB6_STL|18234799|180817043259896SAML00


My code:


index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1)
| eval temp=split(tokenString,"`")
| eval field0=mvindex(temp,0)
| eval field1=mvindex(temp,1)

[afulamba]

sorry for the format of the text it appears. I could not preview it or see the option to edit my post.

[niketn]

@afulamba use the <code> button on Splunk Answers i.e. 101010 to post your code so that special characters do not escape. You can also select code to highlight and use shortcut Ctrl+G to convert to code (which adds four spaces prior to every line of code)

[afulamba]

@niketnilay: Thank you! I will take a not of it for my next posts.