Splunk Search

How to split single field into multiple with different format?

Praveenrocky
New Member

Hi All,

 

i have events like below and i want to extract the fields as TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed. if the data not there for the even it should show as blank or null.

 

Item InsertStatus= 'TotalRecords': 1 'SuccessRecords': 1 'FailedRecords': 0
Entity: DevOpsItemAttribute records Batch 1 SuccessRecords=1 FailedRecords=0
EntityData Entity Delete Status BatchSize=50000 Success=26 Failed=0

 

my output should be like below.

TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed

1,1,0,null,null,null,null,null

null,null,null,1,1,0,null,null,null

null,null,null,null,null,null,50000,26,0

 

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use rex command - assuming your field is the _raw field, then this will work

| rex "TotalRecords':\s+(?<TotalRecords>\d+)\s+'SuccessRecords':\s+(?<SuccessRecords>\d+)\s'FailedRecords':\s(?<FailedRecords>\d+)"
| rex "Entity: DevOpsItemAttribute records Batch (?<Batch>\d+) SuccessRecords=(?<SuccessRecords2>\d+) FailedRecords=(?<FailedRecords2>\d+)"
| rex "EntityData Entity Delete Status BatchSize=(?<BatchSize>\d+) Success=(?<Success>\d+) Failed=(?<Failed>\d+)"
| table TotalRecords SuccessRecords FailedRecords Batch SuccessRecords2 FailedRecords2 BatchSize Success Failed
| fillnull value="null"
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note: you cannot have the same field name twice - in your example, so the second rex will call those fields SuccessRecords2 and FailedRecords2

 

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...