Splunk Search

How to split delimited log, extract a field and group by the value

rmalghan
Explorer

Hi: I have logs that is delimited by ||. I would like to extract nth value from each log and group them by value and count.  I am fairly new to Splunk. This is how far I have gotten. 

 

 

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| <WHAT DO I NEED HERE>
| stats count by <field_value>
| sort -count

 

 

My data

 

 

INSERT||"test Identifier"||"hostname"||"192.168.2.1"||"This is a test log"||....

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

mvindex will allow you to select each of the multi-values

| makeresults
| eval _raw="INSERT||\"test Identifier\"||\"hostname\"||\"192.168.2.1\"||\"This is a test log\"||...."
| eval fields=split(_raw,"||")
| eval field0=mvindex(fields,0)
| eval field1=mvindex(fields,1)
| eval field2=mvindex(fields,2)
| eval field3=mvindex(fields,3)

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...