Splunk Search
Highlighted

Can I define fields like in AWK, basically define extract field without using regex.

Communicator

Let's say we want to process the typical data input like below :

12|Jones Indiana|76|223-33-3323|US|CALIFORNIA|MARRIED

In splunk, I have to use "rex" and do a whole bunch of regex to parse out the fields. Is there a way in Splunk to process these kind of structured log like in awk manner?

awk manner, meaning

awk -F"|" '{print $1" "$2" "$3}'  and so on...

In another words define pattern for delimiter which is "|" and just assign values with field number like $1, $2

I thought powerful engine like splunk would have a similar way to process. Field parsing without doing while bunch of regex.

YhC.

Tags (1)
0 Karma
Highlighted

Re: Can I define fields like in AWK, basically define extract field without using regex.

Splunk Employee
Splunk Employee

You can use the DELIMS parameter to extract fields in that manner. For example, we use the following for csv files:

[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"

To correctly extract the fields in this manner, you should review the following page which details how to configure complex extractions through configuration files:

http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

Highlighted

Re: Can I define fields like in AWK, basically define extract field without using regex.

Splunk Employee
Splunk Employee

You could also use the | extract command at search time. It takes a delims parameter.

Highlighted

Re: Can I define fields like in AWK, basically define extract field without using regex.

Splunk Employee
Splunk Employee

This is sometimes useful, but the extract command's delims is actually a pair pairdelim and kvdelim which are both required. Splunk doesn't generate sequential names like this.

0 Karma
Highlighted

Re: Can I define fields like in AWK, basically define extract field without using regex.

Splunk Employee
Splunk Employee

This has very little to do with power, and more to do with clarity. While it's undoubtedly convenient to be able to throw down one-line expressions, the intention with Splunk is usually to define and name fields meaningfully for shared and long-term re-use.

0 Karma