How to extract pipe delimited field value?

[rrakesh874]

HI All,

I have scenario where my field value is pipe delimited
e.g. Session=PP|OO|GG

if in search I do table of Session, it extracts only first value i.e. PP|.

e.g. ...search | table Session
result -> PP|

How to extract whole value? Appreciate immediate help and reason behind the behavior.

Thanks
Rakesh

[woodcock]

Like this:

... | rex "Session=(?<Session>[^,\s]+)"
... | makemv delim="|" Session

And possibly after that (it depends on whether you need each value to be its own event):

... | mvexpand Session

[gokadroid]

I am assuming that in your log the data will exist as Session=PP|OO|GG<space>. In such case you can follow:

To extract all values intact with pipes from scratch _raw try this:

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| table newSession

If you need the individual values then you can try this query which includes one given by @woodcock:

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| makemv delim="|" newSession
| mvexpand newSession

[rrakesh874]

Thanks for answer, but my requirement is to capture all of it at same time as complete value.

e.g. ..| table Session -> should return "PP|OO|GG".

I think makemv will break whole value in array of values based on '|' delimiter, but I want to print them in different rows in table.

I am trying regex only, but again regex is having few problems in my case, as log msg is bit volatile in format.

Is there no way to have value as whole i.e. "PP|OO|GG"? and why does splunk is picking only first value??

Appreciate answers.

Thanks
Rakesh

[gokadroid]

First part of my answer actually captures everything in newSession

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| table newSession