Splunk Search

How to split single field into multiple with different format?

Praveenrocky
New Member

Hi All,

 

i have events like below and i want to extract the fields as TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed. if the data not there for the even it should show as blank or null.

 

Item InsertStatus= 'TotalRecords': 1 'SuccessRecords': 1 'FailedRecords': 0
Entity: DevOpsItemAttribute records Batch 1 SuccessRecords=1 FailedRecords=0
EntityData Entity Delete Status BatchSize=50000 Success=26 Failed=0

 

my output should be like below.

TotalRecords, SuccessRecords, FailedRecords, Batch, SuccessRecords, FailedRecords,BatchSize, Success, Failed

1,1,0,null,null,null,null,null

null,null,null,1,1,0,null,null,null

null,null,null,null,null,null,50000,26,0

 

Labels (2)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use rex command - assuming your field is the _raw field, then this will work

| rex "TotalRecords':\s+(?<TotalRecords>\d+)\s+'SuccessRecords':\s+(?<SuccessRecords>\d+)\s'FailedRecords':\s(?<FailedRecords>\d+)"
| rex "Entity: DevOpsItemAttribute records Batch (?<Batch>\d+) SuccessRecords=(?<SuccessRecords2>\d+) FailedRecords=(?<FailedRecords2>\d+)"
| rex "EntityData Entity Delete Status BatchSize=(?<BatchSize>\d+) Success=(?<Success>\d+) Failed=(?<Failed>\d+)"
| table TotalRecords SuccessRecords FailedRecords Batch SuccessRecords2 FailedRecords2 BatchSize Success Failed
| fillnull value="null"
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note: you cannot have the same field name twice - in your example, so the second rex will call those fields SuccessRecords2 and FailedRecords2

 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...