How to translate a numeric field name into a readable name to use in a search?

[andreklug]

I have a file that is indexed regulary, with several data in one line:

"245614":"0","245615":"1","245616":"1","245617":"0","245637":"800","245638":"800", ...

1. I would like to be able to translate the field name 245614 (always 6-digit) into a readable name, which i can use in search. I thought that lookups would be fine, but to me it seems that lookup tables are used for field values only? I guess this is documented somewhere, maybe i did not use the right search terms.
2. would it be possible to set up a rule like "if the field name is 245638, divide value by 10"?

Thank you!

[MuS · Accepted solution]

Hi andreklug,

based on your provided information, you can use regex to extract the fields and if it matches your needs set it up as automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutfields

But first the regex approach:

your base search here to get the events | rex "\"245614\"\:\"(?<pressure>\d+)\"\,\"245615\"\:\"(?<temperature>\d+)\"" | table pressure temperature

The lookup approach is not working for you, because lookups are field based. So you would need to extract the field anyway.
Also the division by 10 would be a next step in the search pipeline using eval

hope this helps to get you started ...

cheers. MuS

[Patient]

Good Mus!!!!!!!!

[andreklug]

thank you, i will try this. it was also important for me to know that i do not need to continue searching for a lookup.

[MuS]

Hi andreklug,

so you want all the 6-digits to be fields on their own or do you want all 6-digits to be in the same field? Like:

foo=245614 foo=245615
or
245614=0 245615=1

[andreklug]

Hi MuS,

i would like to have them on their own. For example, 245614 should be translated into "pressure", 245615 into "temperature", so i can search for "pressure" later.

[Patient]

Hello andreklug,

Have you thought to use regular expression?

[andreklug]

i have no idea how regex would bring me closer to a solution. "245614" will always be "pressure", to follow the above example, all terms are fix. So no, i did not 🙂

[Patient]

Ok lead me try