How to split delimited log, extract a field and group by the value

[rmalghan]

Hi: I have logs that is delimited by ||. I would like to extract nth value from each log and group them by value and count.  I am fairly new to Splunk. This is how far I have gotten. 

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| <WHAT DO I NEED HERE>
| stats count by <field_value>
| sort -count

My data

INSERT||"test Identifier"||"hostname"||"192.168.2.1"||"This is a test log"||....

[ITWhisperer]

mvindex will allow you to select each of the multi-values

| makeresults
| eval _raw="INSERT||\"test Identifier\"||\"hostname\"||\"192.168.2.1\"||\"This is a test log\"||...."
| eval fields=split(_raw,"||")
| eval field0=mvindex(fields,0)
| eval field1=mvindex(fields,1)
| eval field2=mvindex(fields,2)
| eval field3=mvindex(fields,3)

[gcusello · Accepted solution]

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

[gcusello]

Hi @rmalghan,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉