Splunk Search

How to extract one field combining different substrings of another field

bharathreddyp
Engager

I have a pattern in my raw field " ..... SPLIT: 11111:22222 ........." which says master id was split to id1:id2. But the master id i need is id1id2. Is there a way to do this. I used rex and managed to get id1:id2, but couldn't take off the colon. I see extracting to 2 fields and doing 'eval' with '+' is an option, but that looks messy

So far, I have |rex "SPLIT: (?\d+:\d+)" ) |
This gives me masterID=11111:22222. But I need masterID=1111122222

0 Karma
1 Solution

sjaworski
Communicator

Another way to use SED would be to pipe to the rex command again.

| rex field=MasterID mode=sed "s/://g"

View solution in original post

sjaworski
Communicator

Another way to use SED would be to pipe to the rex command again.

| rex field=MasterID mode=sed "s/://g"

martin_mueller
SplunkTrust
SplunkTrust

One option is to set up an SEDCMD setting in props.conf that removes the colon from your events during index time. That'll work very well and will be simple to work with at search time, but remember that it does alter what is written to your index and that this cannot be done retroactively.

A purely search-time option is to extract both sections of the id into two fields and to define a calculated field that appends the two together, or to extract the whole id into one field and to define a calculated field that removes the colon.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...