I have the following data in _raw and I need to split the data at the semicolon into multiple fields in a table
LOG INPUT (_raw)
2018-08-22 10:45:19,834 ;Application 1;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:44:19,834 ;Application 2;Status Unknown;SEARCH_STRING;APP_STATUS
2018-08-22 10:43:19,834 ;Application 4;Status Offline;SEARCH_STRING;APP_STATUS
2018-08-22 10:42:19,834 ;Application 5;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:41:19,834 ;Application 3;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:40:19,834 ;Application 1;Status Offline;SEARCH_STRING;APP_STATUS
I want a table that looks like
Date | Application Name | Status | Search | Ingore
2018-08-22 10:45:19,834 | Application 1 | Status Known | SEARCH_STRING | APP_STATUS
2018-08-22 10:44:19,834 | Application 2 | Status Unknown | SEARCH_STRING | APP_STATUS
2018-08-22 10:43:19,834 | Application 4 | Status Offline | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834 | Application 5 | Status Known | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834 | Application 3 | Status Known | SEARCH_STRING | APP_STATUS
2018-08-22 10:41:19,834 | Application 1 | Status Offline | SEARCH_STRING | APP_STATUS
Use the rex
command.
index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...
Hi @slord,
you should rather go for the field extractor tool in splunk to extract out the fields you want. You do have an option to choose "delimiter" ";" as an option there.
Use the rex
command.
index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...
You are awesome, that worked ... thanks!
@slord, if your problem is resolved, please accept an answer to help future readers.