Splunk Search

How could I make this pattern "a=b" from log files into 'a' as the key and 'b' as the value?

Jennifer
Path Finder

Hi, all!

How could I make this pattern "HKL20167991SIT_7_8299=true" from my log files into 'XXXX'(the last four digits) as the key and 'true/false' as the value?

Here's my log file:

HKL20167991SIT_7_8299=true, HKL20167991SIT_8_8260=true, HKL20167991SIT_4_8296=true, HKL20167991SIT_26_8274=true, HKL20167991SIT_32_827A=true, HKL20167991SIT_29_8277=true, HKL20167991SIT_35_827D=true, HKL20167991SIT_22_828E=true, HKL20167991SIT_24_8272=true, HKL20167991SIT_1_825A=true, HKL20167991SIT_31_8279=true, HKL20167991SIT_9_8261=true, HKL20167991SIT_11_8263=true, HKL20167991SIT_14_8266=true, HKL20167991SIT_27_8275=true, HKL20167991SIT_17_8269=true, HKL20167991SIT_37_827F=true, HKL20167991SIT_28_8276=true, HKL20167991SIT_34_827C=true, HKL20167991SIT_20_827C=true, HKL20167991SIT_25_8273=true, HKL20167991SIT_12_8264=true, HKL20167991SIT_15_8267=true, HKL20167991SIT_5_8297=true, HKL20167991SIT_19_826B=true, HKL20167991SIT_3_8295=true, HKL20167991SIT_10_8262=true, HKL20167991SIT_13_8265=true, HKL20167991SIT_18_826A=true, HKL20167991SIT_16_8268=true, HKL20167991SIT_33_827B=true, HKL20167991SIT_36_827E=true, HKL20167991SIT_2_825B=true, HKL20167991SIT_21_827D=true, HKL20167991SIT_23_828F=true, HKL20167991SIT_30_8278=true, HKL20167991SIT_6_8298=true

The result I need is:

Port  Status
8299 true
827D true
8278 true
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that you have multiple entries in the same event, you could try something like this

| rex max_match=0 "_(?<portstatus>\d{4}\=\w+)"
| mvexpand portstatus
| rex field=portstatus "(?<port>\d{4})\=(?<status>\w+)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that you have multiple entries in the same event, you could try something like this

| rex max_match=0 "_(?<portstatus>\d{4}\=\w+)"
| mvexpand portstatus
| rex field=portstatus "(?<port>\d{4})\=(?<status>\w+)"
0 Karma

Jennifer
Path Finder

Hi, IT whisperer!!!

I am very sorry that I didn't show the whole part of my log file:

2022-02-10 08:44:49,603|MjGp1a5-QCeTJzaLizErLEJ|INFO|log|Line availability Hashmap is {HKL20167991SIT_7_8299=false, HKL20167991SIT_8_8260=false, HKL20167991SIT_4_8296=false, HKL20167991SIT_26_8274=false}

2022-02-15 20:51:25,938|vPS567f3KpTgsw7mXARPbxS|INFO|log|Host availabilty Hashmap is {HKL20167984SIT_13_8225=true, HKL20167984SIT_7_82FB=true, HKL20167984SIT_2_82F6=true, HKL20167984SIT_16_8228=true}

I only want to extract the ports from Host availability! How could I rewrite the command?

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are a couple of ways to filter in those events

| regex _raw="Host availabilty Hashmap is"

or

| search "Host availabilty Hashmap"

These remove the events which don't have this string from the events pipeline, so, as long as you don't need these other events further in this search, either way should work

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have to first extract that part from the raw event

| rex "Host availabilty Hashmap is \{(?<payload>[^}]*)\}"
| rex max_match=0 field=payload "_(?<portstatus>\d{4}\=\w+)"
| mvexpand portstatus
| rex field=portstatus "(?<port>\d{4})\=(?<status>\w+)"
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...