How to parse a field to use later in a table

[petersonjared]

Can someone please help me parse the field of FunctionArn for the account id value ( "65123456723" in the example) from the within a search that I can use to pass to a lookup to get the "friendly" account name of that account id?

....
FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today
....

thank you!

[vnravikumar · Accepted solution]

Hi

Check this

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| eval temp=split(test,":") 
| eval accountid = mvindex(temp,5) 
| table accountid

or

| makeresults 
| eval test="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| rex field=test "FunctionArn:\s+\S+\:(?P<accountid>[[:digit:]]+)\:"

[to4kawa]

[[:digit:]], cool.

[DalJeanis]

Equivalent to \d or [0-9]

[petersonjared]

This is fanastic, thank you! I am glad to learn about makeresults.

Is there a way to have makeresult, or a different means, to have the "test" value able to run through the Splunk regex generation tool within extracting fields?

[to4kawa]

| makeresults 
| eval _raw="FunctionArn: arn:aws:lambda:us-east-1:65123456723:function:blah-renew-this-today" 
| rex "FunctionArn:\s+\S+\:(?P<accountid>\d+)\:" 
| appendpipe 
    [ eval accountid1=mvindex(split(_raw,":"),5) 
    | appendpipe 
        [ eval accountid2=replace(_raw,"^.*(\d{11}).*$","\1") 
        | appendpipe 
            [ rex "(?<accountid3>\d{11})"]]]

like that?

[petersonjared]

So basically, I am looking for help in filling in something like:
| rex field=FunctionArn .......................................