Splunk Search
Highlighted

How to get the assigned value of a macro with ":" (colon) as a seperator

Hi,

I need to find the value of PLANDATA_TYPE from the given string in my logs

i.e. PLANDATA_TYPE: ASBFGH, PLANWORK: NotMentioned.

I should get output as ASBFGH when I search for value of PLANDATA_TYPE.
And similarly I should get value as NotMentioned for PLANWORK. The issue is they are not separated by "=" sign but by ":". Any ideas how to proceed?

Tags (2)
0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Splunk Employee
Splunk Employee

Use an extract. Try:

… | rex field=_raw "PLANDATA_TYPE:\s(?<PLANDATA_TYPE>\w+),\sPLANWORK:(?<PLANWORK>\w+)"

View solution in original post

Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Path Finder

Hey jtrucks. Shouldn't there be a whitespace \s between the : and (?<.. or does Splunk trim this automatically when assigning the value to the fieldname?

Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Splunk Employee
Splunk Employee

fixed. Nice call 🙂

0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Thanks jtrucks and dolxor. It worked..!!!

0 Karma
Highlighted

Re: How to get the assigned value of a macro with ":" (colon) as a seperator

Splunk Employee
Splunk Employee

If you can edit the props / transforms directly, this would work just fine with the following transform on your data:


[my_rule]
DELIMS = ":", ","

The first signifies what separates a key from a value, and the second indicates what separates key=value pairs from each other.

0 Karma