Splunk Search

Creating new fields based on a list of keys and a list of values

mikebrittain
Explorer

My data set is web server access logs that include two custom values we insert. The values are lists of keys and lists of values, and can be seen at the end of this entry:

127.0.0.1 - - [27/Oct/2010:17:25:48 +0000] "GET /index.html HTTP/1.1" 200 13211 - "Mozilla/4.0 (compatible; MSIE 7.0)" - 12;14;15;18;22;23;25;35;37;106;47 0;23;1;0;0;1;0;0;1;1;0 

The key list is "12;14;15;18;22;23;25;35;37;106;47" and the value list is "0;0;0;0;0;1;0;0;1;1;0".

These key and value lists can have arbitrary lengths. In this case, there are 11 values in each list separated by semi-colons. But in other log entries, there could be just 1 or 2 values, or there could even be 20 values.

I'm trying to figure out how I can create fields based on the first list and assign values to them based on the second list. For example, the fields/values I'd like to see generated would be:

  • example_12=0
  • example_24=23
  • example_15=1
Tags (2)
0 Karma
1 Solution

southeringtonp
Motivator

This will be difficult via the normal search language, but easy via Python. It is complicated by the variable number of key/value pairs.

Consider implementing a custom search command.

View solution in original post

0 Karma

southeringtonp
Motivator

This will be difficult via the normal search language, but easy via Python. It is complicated by the variable number of key/value pairs.

Consider implementing a custom search command.

0 Karma

mikebrittain
Explorer

I'll accept this answer, but I think the end result will be that we will make some changes to our log format instead.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...