Splunk Search

Extract a ";" delimited field in table

Nidd
Path Finder

My log sample looks like this:

 

testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,

 

I need to extract a few fields in my table. Eg: PlNumber, Src, SrcId

I'm trying like the below:

 

<mysearch> ... | rex "SrcId=(?<SrcId>.*)" | table PlNumber, Src, SrcId

 

 

On the results, the SrcId column is concatenated with the other tail columns, like:

 

--------------------------------------------------------------
|   PlNumber   |   Src   |               SrcId               |
--------------------------------------------------------------
|    testPl    | testSrc | 1234_src1;1234_src2|TxnId=txn-    |
                         | A688|ParentId=|TransactionType=,  |
--------------------------------------------------------------

 

 

What I need:

 

-------------------------------------------------
|   PlNumber   |   Src   |        SrcId         |
-------------------------------------------------
|    testPl    | testSrc | 1234_src1;1234_src2  |
-------------------------------------------------

 

 

I know that my Regex is missing something. 

Kindly help achieving this.

Labels (3)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal |head 1 | fields _raw _time | eval _raw="testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,"
| extract pairdelim=",|" kvdelim="="
| table PlNumber, src, SrcId

try extract

View solution in original post

to4kawa
Ultra Champion
index=_internal |head 1 | fields _raw _time | eval _raw="testServiceName,testTransName,DEVTEST,,,3375598402,15,754,5,2020-07-11 18:41:31.982,2020-07-11 18:41:32.271,29,,,,2,48,248,,,,162,9426,2192,,,,,,,,,,,test,|TxnMessage=SUCCESS|ErrMessage=No Error|PlNumber=testPl|src=testSrc|SrcId=1234_src1;1234_src2|TxnId=txn-A688|ParentId=|TransactionType=,"
| extract pairdelim=",|" kvdelim="="
| table PlNumber, src, SrcId

try extract

Nidd
Path Finder

That works ! Thank you very much !

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...