Splunk Search

Extract pairs of values multiple times but keep pairs together

jbesant
Explorer

I have many events that look like this:

18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]

I have defined two multivalue field extractions that use a transform to repeatedly extract the Id and Place but that does not relate the Id to the Place it just returns all the IDs and the Places.

Field transform with create multivalued field ticked
mv-ID
Id: (?P[A-Z0-9@]{10})

mv-Place
Place: (?P[A-Z0-9]+)

What I want to achieve is that the extraction keeps the ID related to its Place so that when for example I search for the Id CA15000740 I only get one row returned with the Id and Place CI21 and not both Places.

index=sandbox Id=CA15000740 | table Id Place

I'm not sure if I am using the right approach with the field extraction or I need to search differently.

Thanks

0 Karma

niketn
Legend

Try the following run anywhere search based on the sample data provided. The first two pipes i.e. | makeresults and | eval _raw, generates a dummy event as per the question.

| makeresults
| eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
| rex "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s" max_match=0
| eval data=mvzip(Id,place)
| mvexpand data
| makemv data delim=","
| eval Id=mvindex(data,0),place=mvindex(data,1)
| table Id place
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

Is this guaranteed to respect the original ordering/pairing of the raw data?

Wouldn't it be safer to extract the whole "Id: CA15000740, Place: CI21" string into a multi valued field, then apply mvexpand and then extract the individual Id and Place fields?

| makeresults
 | eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
 | rex "(?<IdPlace>\[\s[^\]]+\])" max_match=0
 | mvexpand IdPlace
| rex field=IdPlace "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s"
 | table Id place
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...