Splunk Search

Creating new fields based on a list of keys and a list of values

mikebrittain
Explorer

My data set is web server access logs that include two custom values we insert. The values are lists of keys and lists of values, and can be seen at the end of this entry:

127.0.0.1 - - [27/Oct/2010:17:25:48 +0000] "GET /index.html HTTP/1.1" 200 13211 - "Mozilla/4.0 (compatible; MSIE 7.0)" - 12;14;15;18;22;23;25;35;37;106;47 0;23;1;0;0;1;0;0;1;1;0 

The key list is "12;14;15;18;22;23;25;35;37;106;47" and the value list is "0;0;0;0;0;1;0;0;1;1;0".

These key and value lists can have arbitrary lengths. In this case, there are 11 values in each list separated by semi-colons. But in other log entries, there could be just 1 or 2 values, or there could even be 20 values.

I'm trying to figure out how I can create fields based on the first list and assign values to them based on the second list. For example, the fields/values I'd like to see generated would be:

  • example_12=0
  • example_24=23
  • example_15=1
Tags (2)
0 Karma
1 Solution

southeringtonp
Motivator

This will be difficult via the normal search language, but easy via Python. It is complicated by the variable number of key/value pairs.

Consider implementing a custom search command.

View solution in original post

0 Karma

southeringtonp
Motivator

This will be difficult via the normal search language, but easy via Python. It is complicated by the variable number of key/value pairs.

Consider implementing a custom search command.

0 Karma

mikebrittain
Explorer

I'll accept this answer, but I think the end result will be that we will make some changes to our log format instead.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...