Splunk Search
Highlighted

How to get the assigned value of a macro with ":" (colon) as a seperator

Hi,

I need to find the value of PLANDATA_TYPE from the given string in my logs

i.e. PLANDATA_TYPE: ASBFGH, PLANWORK: NotMentioned.

I should get output as ASBFGH when I search for value of PLANDATA_TYPE.
And similarly I should get value as NotMentioned for PLANWORK. The issue is they are not separated by "=" sign but by ":". Any ideas how to proceed?

Tags (2)
0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Motivator

Use an extract. Try:

… | rex field=_raw "PLANDATA_TYPE:\s(?<PLANDATA_TYPE>\w+),\sPLANWORK:(?<PLANWORK>\w+)"

View solution in original post

Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Path Finder

Hey jtrucks. Shouldn't there be a whitespace \s between the : and (?<.. or does Splunk trim this automatically when assigning the value to the fieldname?

Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Motivator

fixed. Nice call 🙂

0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Thanks jtrucks and dolxor. It worked..!!!

0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Champion

If you can edit the props / transforms directly, this would work just fine with the following transform on your data:


[my_rule]
DELIMS = ":", ","

The first signifies what separates a key from a value, and the second indicates what separates key=value pairs from each other.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.