Splunk Search

How to extract, convert and show data

Sentira
Explorer

I have following data and :

......
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[10202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[00202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
.....


I need to extract the "First_Status" and "Second_Status"  of a Chute and the field from log data and each 2 characters of value belongs to one Item. 
Example: first character set "20",  2 is  for First_Status and means OK and 0 is for Second_Status and means NOT OK for Item_1.  (Total Items= 128/2 = 64)
Finally I want to extract the raw data and convert to First_Status , Second_Status and link them to a fix Item
(Item_1...Item_64):

_timeItemsFirst_StatusSecond_Status
2021-06-18 21:05:45.037Item_1OkOk
2021-06-18 21:05:46.037Item_1Not OkNot Ok
2021-06-18 21:05:47.037Item_2OkOk
2021-06-18 21:05:49.037Item_n.........

....

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...