Splunk Search

Field Extraction

carmackd
Communicator

I have a log file that looks like this:

Wed Aug 11 14:27:48 GMT 2010 | Inactive Users Last 7 Days---> | 123456789 | 321654987 | 489756123 | 111000555

Wed Aug 12 14:20:18 GMT 2010 | Inactive Users Last 7 Days---> | 123456789 | 321654987 | 489756123 | 111000555 | 222211145 | 789789741

Basically I want to extract this into three fields, timestamp, range, and userID. Currently I'm using a transform with a "|" deliminator. The problem is, this is only getting the first userID, not the ones that follow. keep in mind, each event can have different amounts of userID's. For example, the first event has 4 userID's, and the second has 6 userID's, another could have 20. I want to extract them all into a single field.

Tags (1)
0 Karma

twinspop
Influencer

rex with max_match?

| rex field=_raw "\|(?<users>[0-9]+)" max_match=100

That should result in a users multi-valued field. (With a max of 100 users contained therein.)

hbazan
Path Finder

I almost got it:

| rex field=raw "Inactive Users Last 7 Days--->(?<users>.*)" | eval user=split(users," | ") | top user

But, there's a empty user value. Get rid of that and you're done.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...