Splunk Search

Extract pairs of values multiple times but keep pairs together

jbesant
Explorer

I have many events that look like this:

18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]

I have defined two multivalue field extractions that use a transform to repeatedly extract the Id and Place but that does not relate the Id to the Place it just returns all the IDs and the Places.

Field transform with create multivalued field ticked
mv-ID
Id: (?P[A-Z0-9@]{10})

mv-Place
Place: (?P[A-Z0-9]+)

What I want to achieve is that the extraction keeps the ID related to its Place so that when for example I search for the Id CA15000740 I only get one row returned with the Id and Place CI21 and not both Places.

index=sandbox Id=CA15000740 | table Id Place

I'm not sure if I am using the right approach with the field extraction or I need to search differently.

Thanks

0 Karma

niketnilay
Legend

Try the following run anywhere search based on the sample data provided. The first two pipes i.e. | makeresults and | eval _raw, generates a dummy event as per the question.

| makeresults
| eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
| rex "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s" max_match=0
| eval data=mvzip(Id,place)
| mvexpand data
| makemv data delim=","
| eval Id=mvindex(data,0),place=mvindex(data,1)
| table Id place
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

Is this guaranteed to respect the original ordering/pairing of the raw data?

Wouldn't it be safer to extract the whole "Id: CA15000740, Place: CI21" string into a multi valued field, then apply mvexpand and then extract the individual Id and Place fields?

| makeresults
 | eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
 | rex "(?<IdPlace>\[\s[^\]]+\])" max_match=0
 | mvexpand IdPlace
| rex field=IdPlace "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s"
 | table Id place
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!