Splunk Search

How to split a field value and create multiple new fields at search-time?

anoopambli
Communicator

I have a search which returns drive usage of Windows servers. The information comes up like below in the field:

C: 50.15 😧 2.57
C: 32.32 E: 0.74 F: 0.72 G: 0.74 I: 0.72
C: 45.06 F: 0.77 G: 1.05

I want to split that into individual fields like below,

C:50
D:2.57

I am not able to figure out how to use eval to split this into multiple new fields. Can someone help me with this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This will put an indefinite number of drives into two multi-valued variables.

... | rex max_match=0 "(?P<drive>[A-Z]:)\s(?P<usage>[0-9\.]+)" | ...

You can then use the mv* commands to extract the individual drives and usages.

---
If this reply helps you, Karma would be appreciated.

cpetterborg
SplunkTrust
SplunkTrust

I'm not sure of your reply about naming the fields, so here goes with the easiest (drive1, etc.):

<your search> | rex field=_raw "(?P<drive1>[C-Z]:\s\d+\.\d+)(\s+(?P<drive2>[C-Z]:\s\d+.\d+))?(\s+(?P<drive3>[C-Z]:\s\d+.\d+))?(\s+(?P<drive4>[C-Z]:\s\d+.\d+))?(\s+(?P<drive5>[C-Z]:\s\d+.\d+))?"

This assumes that there is nothing else in the event. If you have the data in a single field, then you can substitute that field name for _raw in the above rex.

If you do want the fields named something else, please describe exactly what you want and I can provide an update to this answer.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I decided to provide the driveC, driveD, etc. method as well. You will have to add to it as needed for additional drives. It also assumes that they will be listed in alphabetical order:

<your search> | rex field=_raw "(C:\s(?P<driveC>\d+\.\d+))?(\s+D:\s(?P<driveD>\d+.\d+))?(\s+E:\s(?P<driveE>\d+.\d+))?(\s+F:\s(?P<driveF>\d+.\d+))?(\s+G:\s(?P<driveG>\d+.\d+))?(\s+H:\s(?P<driveH>\d+.\d+))?(\s+I:\s(?P<driveI>\d+.\d+))?(\s+J:\s(?P<driveJ>\d+.\d+))?(\s+K:\s(?P<driveK>\d+.\d+))?(\s+L:\s(?P<driveL>\d+.\d+))?(\s+M:\s(?P<driveM>\d+.\d+))?"

If they are not to be in alphabetical order, the it will take a bit more to do.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Do you want their fileds named sequentially like drive1, drive2, drive3, etc., or something like driveC, driveD, driveE, etc.?

0 Karma

anoopambli
Communicator

C, D, E..etc

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...