Can I define fields like in AWK, basically define extract field without using regex.

[clyde772]

Let's say we want to process the typical data input like below :

12|Jones Indiana|76|223-33-3323|US|CALIFORNIA|MARRIED

In splunk, I have to use "rex" and do a whole bunch of regex to parse out the fields. Is there a way in Splunk to process these kind of structured log like in awk manner?

awk manner, meaning

awk -F"|" '{print $1" "$2" "$3}'  and so on...

In another words define pattern for delimiter which is "|" and just assign values with field number like $1, $2

I thought powerful engine like splunk would have a similar way to process. Field parsing without doing while bunch of regex.

YhC.

[gkanapathy]

This has very little to do with power, and more to do with clarity. While it's undoubtedly convenient to be able to throw down one-line expressions, the intention with Splunk is usually to define and name fields meaningfully for shared and long-term re-use.

[Dan]

You could also use the | extract command at search time. It takes a delims parameter.

[gkanapathy]

This is sometimes useful, but the extract command's delims is actually a pair pairdelim and kvdelim which are both required. Splunk doesn't generate sequential names like this.

[Simeon]

You can use the DELIMS parameter to extract fields in that manner. For example, we use the following for csv files:

[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"

To correctly extract the fields in this manner, you should review the following page which details how to configure complex extractions through configuration files:

http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...