Splunk Search

How do I extract a comma separated field during search?

andyk
Path Finder

I have event data in Splunk that look like this:

2013-02-14 11:32:46.4314 app=ws3 sev=INFO mid=1325748 , Fooo, Barr, , 7 rue de fuubarr, , 44540, xx zzz la yyyyy, , FR, ENG, , 1031, EUR,,,

I need to do an Ad Hoc report that count the events grouped by country. The country information is in the filed that contains "FR" in this example event.

Tags (1)
0 Karma

rsantkumar
Observer

hi @jeff @andyk : I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon).

Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;

I am trying to extract the 3 fields and display as a table in splunk. Please help.

0 Karma

jeff
Contributor

Assuming all of your data has the same format:

{ search criteria } 
| rex field=_raw "^([^,]+,){9} +(?<country>[^,]+)"

rsantkumar
Observer

hi @jeff @andyk @Rob : I have 3 fields(Key, Version, Date) seperated by comma and records(can be many) seperated by ;(semicolon).

Example: pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;

I am trying to extract the 3 fields and display as a table in splunk. Please help.

0 Karma

andyk
Path Finder

Works perfect! Thanks!

0 Karma

Rob
Splunk Employee
Splunk Employee

Nicely done!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...