Splunk Search

Extract multiple name value pairs from a field

jbax
Engager

Hello,

I have a field that contains the string below. 

a) There can be fewer/more than the 4 events listed below.  

b) Value of the events will be different.

(event=aa)(event=bb)(event=cc)(event=normal)

 

=====================================================

1) How can I create a new field events that equals "aa,bb,cc,normal"?

2) Is there a way to exclude the normal event?  So field events = "aa,bb,cc" only? 

3) Is there a way to make it list like so I can filter on these events values?  (ie - potentially count # of events with aa or cc or (aa + cc)?) 

4) Is there a way to count the events returned in the field?  

Thank you!

Labels (2)
0 Karma
1 Solution

renjith_nair
Legend

@jbax,

Try regex

 

|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"

 

From the result, you can do rest of the stats

Sample data

 

|makeresults|eval events="(event=aa)(event=bb)(event=cc)(event=normal) (event=xx)(event=yy)(event=zz)(event=normal)"|makemv events|mvexpand events|streamstats count as uniqueField
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
|eval Total=mvcount(EVENTS)
|stats count as event_count,max(Total) as Total by EVENTS,uniqueField

 

 

Let's know your final output format. We can fine tune w.r.t count and total

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@jbax,

Try regex

 

|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"

 

From the result, you can do rest of the stats

Sample data

 

|makeresults|eval events="(event=aa)(event=bb)(event=cc)(event=normal) (event=xx)(event=yy)(event=zz)(event=normal)"|makemv events|mvexpand events|streamstats count as uniqueField
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
|eval Total=mvcount(EVENTS)
|stats count as event_count,max(Total) as Total by EVENTS,uniqueField

 

 

Let's know your final output format. We can fine tune w.r.t count and total

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jbax
Engager

@renjith_nair 

 

Thanks, this worked well for me!   Would you know of a way to exclude values (ie - normal)?  

Thank you!

0 Karma

renjith_nair
Legend

Sure. Just add this after the rex command

|eval EVENTS=mvfilter(!match(EVENTS,"normal"))
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...