Splunk Search

Extracting field values from a single line inside a multi-line transaction group

joshd
Builder

Hello, to begin here is a sample of the data I am working with, they are events grouped using the transaction command based on the msg field:

Jan 12 10:41:12 dev audispd: node=dev type=CWD msg=audit(1294847043.492:245706):  cwd="/home/dev/jboss-5.1.0.GA/server/dev_mtd/tmp/3j001-ggz1mk-gitasxy0-1-gitat6nz-v/admin-console.war/WEB-INF/lib"
Jan 12 10:41:12 dev audispd: node=dev type=PATH msg=audit(1294847043.492:245706): item=0  name="/home/dev/jboss-5.1.0.GA/server/dev_mtd/tmp/3j001-ggz1mk-gitasxy0-1-gitat6nz-v/admin-console.war/WEB-INF/lib" inode=1438996 dev=fd:00 mode=040775 ouid=506 ogid=507 rdev=00:00 obj=user_u:object_r:user_home_t:s0 
Jan 12 10:41:12 dev audispd: node=dev type=PATH msg=audit(1294847043.492:245706): item=1 name="jboss-el-1.0_02.CR2.jar" inode=1438998 dev=fd:00 mode=0100664 ouid=506 ogid=507 rdev=00:00 obj=user_u:object_r:user_home_t:s0 

... Now as you can see there are three lines, the second and third line have the exact same fields but with differing values. This is where my issue begins. I would like to extract the value of the name field into a new variable ONLY if the value of it is not equal to value of the cwd field from the first line, if it is equal then I would like it to use the value of the name field from the third line. How would I go about doing this? Is there a way to separate the events inside the transaction and compare the field values individually even if they have the same name?

To try and be more clear on what I'm trying to accomplish...

IF name1 == cwd THEN
  new_field = name2
ELSE
  new_field = name1

I hope this all makes sense 🙂

Thanks!

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee
... 
| transaction your_transaction
| rex "(?m)name\=\"(?<name1>[^\"]+).*\n.*name\=\"(?<name2>[^\"]+)"
| eval new_field=if(name1=cwd,name2,name1)

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee
... 
| transaction your_transaction
| rex "(?m)name\=\"(?<name1>[^\"]+).*\n.*name\=\"(?<name2>[^\"]+)"
| eval new_field=if(name1=cwd,name2,name1)
0 Karma

joshd
Builder

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...