Splunk Search

How to organize values in Statistics search?

ecm9210
Engager

Hi, I have a blob of text in both the title and description file, I've tried looking for how to seperate them when I am seraching but I have not found anything. It looks like

Question? NoIf yes, Question? N/ADoes this even do something? N/AIs the event a false positive? YesTicket number: N/ASource Unique Identifier (UI): Alert trigger time: Date/time UTCEvent start time: Date/time

etc

I would like it to look like this
Question? No
If yes, Question? N/A
Does this even do something? N/A
Is the event a false positive? Yes
Ticket number: N/A
Source Unique Identifier (UI):

Alert trigger time: Date/time UTC
Event start time: Date/time

The search I'm using is this

| inputlookup append=t investigative_canvas_entries_lookup
| table _time creator owner title description canvas_id
| sort -_time

0 Karma
1 Solution

DalJeanis
Legend

First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.

If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....

...if you want the questions and answers each separate...

| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"

...if you want each question and answer as a unit ...

| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"

View solution in original post

DalJeanis
Legend

First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data.

If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following....

...if you want the questions and answers each separate...

| rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)"

...if you want each question and answer as a unit ...

| rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)"
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...