Splunk Search

How to retrieve multiple values of a single field in a single table row?

Path Finder

I have a few logs in this format:

|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True| 

Where preferenceDetails is a list and there could be a number of preferenceType, preferenceAction, preferenceEligible within it.

Can I obtain a result in this format? :

-----------------------------------------------------------
      preferenceType_preferenceAction_preferenceEligible
-----------------------------------------------------------
BILL_NOTIFICATION_OPT_IN_True, POLICY_DOCUMENTS_OPT_IN_True
-----------------------------------------------------------

i.e. I wish to have values separated by '_' and records separated by ','.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@Nidd, can you explain with example of field and value based on above data as to what they would be after finding values and separating field and values.

You can use extract command with raw data i.e. `| extract pairdelim="," kvdelim=""`. Following is a run anywhere search based on your data.

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| extract pairdelim="," kvdelim="_"

Or you can try the following rex command

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| rex "=(?<key>\w+)_(?<value>[^,]+)," max_match=0
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

SplunkTrust
SplunkTrust

@Nidd, can you explain with example of field and value based on above data as to what they would be after finding values and separating field and values.

You can use extract command with raw data i.e. `| extract pairdelim="," kvdelim=""`. Following is a run anywhere search based on your data.

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| extract pairdelim="," kvdelim="_"

Or you can try the following rex command

| makeresults 
| eval _raw="|preferenceDetails:-preferenceType=BILL_NOTIFICATION,preferenceAction=OPT_IN,preferenceEligible=True|preferenceType=POLICY_DOCUMENTS,preferenceAction=OPT_IN,preferenceEligible=True|"
| rex "=(?<key>\w+)_(?<value>[^,]+)," max_match=0
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Path Finder

Modified your 2nd query a little and it worked fine Niketnilay ! Thanks a lot for your effort 🙂