I have a file that is indexed regulary, with several data in one line:
"245614":"0","245615":"1","245616":"1","245617":"0","245637":"800","245638":"800", ...
Thank you!
Hi andreklug,
based on your provided information, you can use regex to extract the fields and if it matches your needs set it up as automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutfields
But first the regex approach:
your base search here to get the events | rex "\"245614\"\:\"(?<pressure>\d+)\"\,\"245615\"\:\"(?<temperature>\d+)\"" | table pressure temperature
The lookup
approach is not working for you, because lookups are field based. So you would need to extract the field anyway.
Also the division by 10 would be a next step in the search pipeline using eval
hope this helps to get you started ...
cheers. MuS
Hi andreklug,
based on your provided information, you can use regex to extract the fields and if it matches your needs set it up as automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutfields
But first the regex approach:
your base search here to get the events | rex "\"245614\"\:\"(?<pressure>\d+)\"\,\"245615\"\:\"(?<temperature>\d+)\"" | table pressure temperature
The lookup
approach is not working for you, because lookups are field based. So you would need to extract the field anyway.
Also the division by 10 would be a next step in the search pipeline using eval
hope this helps to get you started ...
cheers. MuS
Good Mus!!!!!!!!
thank you, i will try this. it was also important for me to know that i do not need to continue searching for a lookup.
Hi andreklug,
so you want all the 6-digits to be fields on their own or do you want all 6-digits to be in the same field? Like:
foo=245614 foo=245615
or
245614=0 245615=1
Hi MuS,
i would like to have them on their own. For example, 245614 should be translated into "pressure", 245615 into "temperature", so i can search for "pressure" later.
Hello andreklug,
Have you thought to use regular expression?
i have no idea how regex would bring me closer to a solution. "245614" will always be "pressure", to follow the above example, all terms are fix. So no, i did not 🙂
Ok lead me try