Splunk Search

How do I split _raw data into multiple table fields?

slord
Engager

I have the following data in _raw and I need to split the data at the semicolon into multiple fields in a table

LOG INPUT (_raw)

2018-08-22 10:45:19,834 ;Application 1;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:44:19,834 ;Application 2;Status Unknown;SEARCH_STRING;APP_STATUS
2018-08-22 10:43:19,834 ;Application 4;Status Offline;SEARCH_STRING;APP_STATUS
2018-08-22 10:42:19,834 ;Application 5;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:41:19,834 ;Application 3;Status Known;SEARCH_STRING;APP_STATUS
2018-08-22 10:40:19,834 ;Application 1;Status Offline;SEARCH_STRING;APP_STATUS

I want a table that looks like

Date                     | Application Name  | Status         | Search        | Ingore
2018-08-22 10:45:19,834  | Application 1     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:44:19,834  | Application 2     | Status Unknown | SEARCH_STRING | APP_STATUS
2018-08-22 10:43:19,834  | Application 4     | Status Offline | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 5     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:42:19,834  | Application 3     | Status Known   | SEARCH_STRING | APP_STATUS
2018-08-22 10:41:19,834  | Application 1     | Status Offline | SEARCH_STRING | APP_STATUS
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the rex command.

index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

pyro_wood
SplunkTrust
SplunkTrust

Hi @slord,

you should rather go for the field extractor tool in splunk to extract out the fields you want. You do have an option to choose "delimiter" ";" as an option there.

richgalloway
SplunkTrust
SplunkTrust

Use the rex command.

index=foo | rex "(?<Date>[^;]+)\s;(?<Application>[^;]+);(?<Status>[^;]+);(?<Search>[^;]+);(?<Ignore>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

slord
Engager

You are awesome, that worked ... thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@slord, if your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on