Splunk Search

How to extract, convert and show data

Sentira
Explorer

I have following data and :

......
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[10202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[00202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
.....


I need to extract the "First_Status" and "Second_Status"  of a Chute and the field from log data and each 2 characters of value belongs to one Item. 
Example: first character set "20",  2 is  for First_Status and means OK and 0 is for Second_Status and means NOT OK for Item_1.  (Total Items= 128/2 = 64)
Finally I want to extract the raw data and convert to First_Status , Second_Status and link them to a fix Item
(Item_1...Item_64):

_timeItemsFirst_StatusSecond_Status
2021-06-18 21:05:45.037Item_1OkOk
2021-06-18 21:05:46.037Item_1Not OkNot Ok
2021-06-18 21:05:47.037Item_2OkOk
2021-06-18 21:05:49.037Item_n.........

....

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...