Splunk Search

How to split multiple fields?

paras
Explorer

I need to be able to split multiple fields that have a delimiter of "|#|". The field name will differ depending on the log. Is there a way to do a mass split using props.conf or transforms.conf. Is there a way to do this without having to write a eval statement for every single field that may come?

EX:

log:: time=XXXX,src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3"......

I want to split src_ip, and user. 

Labels (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Whereas you cannot do this in props.conf or transforms.conf, you don't necessarily have to write each split.  That's why SPL includes iteration commands such as foreach.

| foreach src_ip, user
  [eval <<FIELD>> = split(<<FIELD>>, "|#|")]

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the split function.

 

| makeresults | eval src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3"
| eval srcs=split(src_ip, "|#|"), users=split(user,"|#|")

 

You can do it at index time using INGEST_EVAL.  In transforms.conf:

INGEST_EVAL srcs=split(src_ip, "|#|")
INGEST_EVAL users=split(user,"|#|")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...