Splunk Search

How to extract multiple values from output to create new column in table with associated values

najaplit
New Member

Hello,

I have a search query that produces a value similar to below.  What i am trying to accomplish is to extract the "Data", "Time", and "Notes" section and to output those values to a table with each in a separate column.   What would be an efficient way to accomplish this?  I am seeing some regex syntax fines but not as familiar with it.  Any help is appreciated.  Thanks!

----------------------------------------

Value:

CompName: XXX XXX Type: XXX EmpName: XXX Date: XX-XX-XXXX Time 9:00AM Notes: XXXX

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I modified your example show it working for PM times and included a colon after Time to make it consistent, but this is an example of how you might approach it

| makeresults 
| eval _raw="CompName: XXX XXX Type: XXX EmpName: XXX Date: 23-03-2021 Time: 9:00PM Notes: WXYZ"
| rex "Date:\s(?<date>[^\s]+)\sTime:\s(?<time>[^\s]+)\sNotes:\s(?<notes>.*)"
| eval _time=strptime(date." ".time,"%d-%m-%Y %I:%M%p")
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...