Splunk Search

How to split single field into multiple with different format?

Praveenrocky
New Member

Hi All,

 

i have events like below and i want to extract the fields as TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed. if the data not there for the even it should show as blank or null.

 

Item InsertStatus= 'TotalRecords': 1 'SuccessRecords': 1 'FailedRecords': 0
Entity: DevOpsItemAttribute records Batch 1 SuccessRecords=1 FailedRecords=0
EntityData Entity Delete Status BatchSize=50000 Success=26 Failed=0

 

my output should be like below.

TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed

1,1,0,null,null,null,null,null

null,null,null,1,1,0,null,null,null

null,null,null,null,null,null,50000,26,0

 

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use rex command - assuming your field is the _raw field, then this will work

| rex "TotalRecords':\s+(?<TotalRecords>\d+)\s+'SuccessRecords':\s+(?<SuccessRecords>\d+)\s'FailedRecords':\s(?<FailedRecords>\d+)"
| rex "Entity: DevOpsItemAttribute records Batch (?<Batch>\d+) SuccessRecords=(?<SuccessRecords2>\d+) FailedRecords=(?<FailedRecords2>\d+)"
| rex "EntityData Entity Delete Status BatchSize=(?<BatchSize>\d+) Success=(?<Success>\d+) Failed=(?<Failed>\d+)"
| table TotalRecords SuccessRecords FailedRecords Batch SuccessRecords2 FailedRecords2 BatchSize Success Failed
| fillnull value="null"
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note: you cannot have the same field name twice - in your example, so the second rex will call those fields SuccessRecords2 and FailedRecords2

 

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...