Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Field extract and zip them.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Field extract and zip them.
(product=X Phone , 512 ГБ, золотой,shipMethodCode=E3,qty=1,deliveryType=STH,partNumber=MRU/A,deliveryDate=4 Окт - 11 Окт,commitCode=200,resolvedDate=4 Окт - 11 Окт,product=Phone, (PRODUCT)RED_Phone,shipMethodCode=E3,qty=1,deliveryType=STH,partNumber=M2ZM/A,deliveryDate=Пн 23 Сен,commitCode=24,resolvedDate=Пн 23 Сен)
I want to extract product and commitCode and Zip them.
I want display
Phone;commitCode
X Phone;200
RED_Phone;24
Can someone help please.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sandeepmakkena,
If you have kv_mode on auto the fields phone and commitCode should be automatically extracted. As shown here :
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Automatickey-valuefieldextractionsatse...
To zip the two fields together with a semi-colon seperator you can use the following eval:
| eval ZippedField=mvzip(phone, commitCode, ";")
Let me know if that helps and if you require a regex for the extraction instead of the automated kv extraction.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@sandeepmakkena, please let me know if the answer was helpful and if you need further help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hmm your product characters are in different formats.
you have product= and (PRODUCT) , are they the only expected formats before the product name is mentioned in your events?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am new to this data. product= and (PRODUCT) happens when a user orders two or more at one transaction. I am not that's what you're looking for.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
