Splunk Search

How to extract pipe delimited field value?

New Member

HI All,

I have scenario where my field value is pipe delimited
e.g. Session=PP|OO|GG

if in search I do table of Session, it extracts only first value i.e. PP|.

e.g. ...search | table Session
result -> PP|

How to extract whole value? Appreciate immediate help and reason behind the behavior.

Thanks
Rakesh

0 Karma

Esteemed Legend

Like this:

... | rex "Session=(?<Session>[^,\s]+)"
... | makemv delim="|" Session

And possibly after that (it depends on whether you need each value to be its own event):

... | mvexpand Session
0 Karma

Motivator

I am assuming that in your log the data will exist as Session=PP|OO|GG<space>. In such case you can follow:

To extract all values intact with pipes from scratch _raw try this:

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| table newSession

If you need the individual values then you can try this query which includes one given by @woodcock:

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| makemv delim="|" newSession
| mvexpand newSession

New Member

Thanks for answer, but my requirement is to capture all of it at same time as complete value.

e.g. ..| table Session -> should return "PP|OO|GG".

I think makemv will break whole value in array of values based on '|' delimiter, but I want to print them in different rows in table.

I am trying regex only, but again regex is having few problems in my case, as log msg is bit volatile in format.

Is there no way to have value as whole i.e. "PP|OO|GG"? and why does splunk is picking only first value??

Appreciate answers.

Thanks
Rakesh

0 Karma

Motivator

First part of my answer actually captures everything in newSession

your query to return the events
| rex field=_raw "Session=(?<newSession>[\S]+)"
| table newSession
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!