Splunk Search

How to parse a field to use later in a table

petersonjared
Explorer

Can someone please help me parse the field of FunctionArn for the account id value ( "65123456723" in the example) from the within a search that I can use to pass to a lookup to get the "friendly" account name of that account id?

....
FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today
....

thank you!

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| eval temp=split(test,":") 
| eval accountid = mvindex(temp,5) 
| table accountid

or

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| rex field=test "FunctionArn:\s+\S+\:(?P<accountid>[[:digit:]]+)\:"

View solution in original post

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| eval temp=split(test,":") 
| eval accountid = mvindex(temp,5) 
| table accountid

or

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| rex field=test "FunctionArn:\s+\S+\:(?P<accountid>[[:digit:]]+)\:"

View solution in original post

to4kawa
SplunkTrust
SplunkTrust

[[:digit:]], cool.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Equivalent to \d or [0-9]

0 Karma

petersonjared
Explorer

This is fanastic, thank you! I am glad to learn about makeresults.

Is there a way to have makeresult, or a different means, to have the "test" value able to run through the Splunk regex generation tool within extracting fields?

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| rex "FunctionArn:\s+\S+\:(?P<accountid>\d+)\:" 
| appendpipe 
    [ eval accountid1=mvindex(split(_raw,":"),5) 
    | appendpipe 
        [ eval accountid2=replace(_raw,"^.*(\d{11}).*$","\1") 
        | appendpipe 
            [ rex "(?<accountid3>\d{11})"]]]

like that?

0 Karma

petersonjared
Explorer

So basically, I am looking for help in filling in something like:
| rex field=FunctionArn .......................................

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!