Splunk Search

Extract variable between pipe symbol from log and use it for query

krishman23
Explorer

I have a log generated in splunk which will have unique id  in with pipe symbols:

ex:

 

 

 

 

19:46:47.146 - [http-nio-8000-exec-9] INFO edu.test.controller |{My Var1}|{My Var2}|{myVar3}| - {log message}.

 

 

 

 

I need to perform a query based on {My Var1}.

Also need to list (dedup) all logs best on {My Var1}.

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\|(?<Var1>[^\|]+)\|(?<Var2>[^\|]+)\|(?<Var3>[^\|]+)\|\s\-\s(?<logmessage>.*)"

View solution in original post

0 Karma

krishman23
Explorer

@ITWhisperer: i additional case in this rex, some time my logmessage will have URL as 

Req URL : hello/test/content

 or Req URL : hello/test/content/ , i need to truncate / of second request. Can you help with this ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=events mode=sed "s/(?<url>[^\/]+\/[^\/]+\/[^\/]+)(?<slash>\/*)/\1/g"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\|(?<Var1>[^\|]+)\|(?<Var2>[^\|]+)\|(?<Var3>[^\|]+)\|\s\-\s(?<logmessage>.*)"
0 Karma

krishman23
Explorer

my bad , got it what you are saying.,

As second part of my question how can we user Var1 as variable for next search?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depends on what you want to get out of your data

| dedup Var1
| where Var2="xyz"
| stats count by Var3
0 Karma

krishman23
Explorer

but var1,var2,var3  are unknown to me, those are variables in log

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The rex extracts the value between the first two pipes into a field called Var1, the value between the second and third pipes into a field called Var2, etc. You can then use these fields in your query or just display them in as columns in a table. Is this not what you want to do?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...