Splunk Search

Assign keys to tokenised string

afulamba
Explorer

Hi there,
Can someone help me with reading the tokenized string and assign the keys to each index retrieved. It is difficult for me as it is not key/value format to read.

Log sample:

CustomerServicegetPointDetails66860x00000000Successful Response230Louis/ST=Missouri/C=US PRODESB6_STL|18234799|180817043259896SAML00

I know which values is for what field in the sequence they appear in the logs. It does has space as a value too. I did tried below but since there are more than 20 fields I have to extracts, the query becomes very long and ugly and can cause performance too.


index=app sourcetype = audit

| eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1)
| eval temp=split(tokenString,"
")
| eval field0=mvindex(temp,0)
| eval field1=mvindex(temp,1)


I did check few regex option on web, that was also long query too.

Please advise.

Thanks,

Tags (1)
0 Karma

afulamba
Explorer

Can someone help me here, please?

Thanks,
Amit

0 Karma

afulamba
Explorer

Reposting sample log and my code

CustomerServicegetPointDetails6686435528520x00000000Successful Response230Louis/ST=Missouri/C=USPRODESB6_STL|18234799|180817043259896SAML00

My code:


index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1)
| eval temp=split(tokenString,"`")
| eval field0=mvindex(temp,0)
| eval field1=mvindex(temp,1)

0 Karma

afulamba
Explorer

sorry for the format of the text it appears. I could not preview it or see the option to edit my post.

0 Karma

niketn
Legend

@afulamba use the <code> button on Splunk Answers i.e. 101010 to post your code so that special characters do not escape. You can also select code to highlight and use shortcut Ctrl+G to convert to code (which adds four spaces prior to every line of code)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

afulamba
Explorer

@niketnilay: Thank you! I will take a not of it for my next posts.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...