I need to be able to split multiple fields that have a delimiter of "|#|". The field name will differ depending on the log. Is there a way to do a mass split using props.conf or transforms.conf. Is there a way to do this without having to write a eval statement for every single field that may come?
EX:
log:: time=XXXX,src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3"......
I want to split src_ip, and user.
Use the split function.
| makeresults | eval src_ip="123.123.123.123|#|234.234.234.234|#|",user="foo1|#|foo2|#|foo3"
| eval srcs=split(src_ip, "|#|"), users=split(user,"|#|")
You can do it at index time using INGEST_EVAL. In transforms.conf:
INGEST_EVAL srcs=split(src_ip, "|#|")
INGEST_EVAL users=split(user,"|#|")