Let's say we want to process the typical data input like below :
12|Jones Indiana|76|223-33-3323|US|CALIFORNIA|MARRIED
In splunk, I have to use "rex" and do a whole bunch of regex to parse out the fields. Is there a way in Splunk to process these kind of structured log like in awk manner?
awk manner, meaning
awk -F"|" '{print $1" "$2" "$3}' and so on...
In another words define pattern for delimiter which is "|" and just assign values with field number like $1, $2
I thought powerful engine like splunk would have a similar way to process. Field parsing without doing while bunch of regex.
YhC.
This has very little to do with power, and more to do with clarity. While it's undoubtedly convenient to be able to throw down one-line expressions, the intention with Splunk is usually to define and name fields meaningfully for shared and long-term re-use.
You could also use the | extract command at search time. It takes a delims parameter.
This is sometimes useful, but the extract
command's delims
is actually a pair pairdelim
and kvdelim
which are both required. Splunk doesn't generate sequential names like this.
You can use the DELIMS parameter to extract fields in that manner. For example, we use the following for csv files:
[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"
To correctly extract the fields in this manner, you should review the following page which details how to configure complex extractions through configuration files: