Splunk Search

Extracting values inside of a [] , which are , separated with spaces

RamMur
Explorer

trying to use rex to get the contents for the field letterIdAndDeliveryIndicatorMap.

For example, Logged string letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]

I want to extract the contents between the [] , which is abc=P, efg=P, HijKlmno=E and then find stats on them.

I was trying something like 

rex  field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\] ]+)"

but, its not working as expected.

Thanks in advance!

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @ITWhisperer says, "not working as expected", "doesn't work", etc., should be forbidden in this forum.  More specifically, if your raw events contain things like "letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]", Splunk's default extraction should have given you abc, efg, HijKlmlo without you asking. (It also gives you a field letterIdAndDeliveryIndicatorMap.) If you do table *, what do you see?

Here is an emulation

| makeresults
| eval _raw="letterIdAndDeliveryIndicatorMap=[abc=P, efg=P, HijKlmno=E]"
| extract

Screenshot 2024-06-04 at 11.58.13 AM.png

0 Karma

RamMur
Explorer

yes, found that my regex had a space between ]], once fixed, was able to extract them as "abc=P, efg=P, HijKlmno=E" , thanks. next trying to get stats on count of abc=P.

0 Karma

dtburrows3
Builder

You should be able to use the split function after extracting which will convert it to a MV field and then utilize a stats against that MV field.
Something like this

<base_search>
    | rex field=_raw "letterIdAndDeliveryIndicatorMap=\[(?<letterIdAry>[^\]]+)"
    | eval
        letterIdAry=split(letterIdAry, ","),
        letterIdAry=case(
            mvcount(letterIdAry)==1, trim(letterIdAry, " "),
            mvcount(letterIdAry)>1, mvmap(letterIdAry, trim(letterIdAry, " "))
            )
    | stats
        count as event_count
            by letterIdAry


Example output:

dtburrows3_0-1717523007986.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by "not working as expected" (because it looks like you should have extracted something at least)?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...