I have a field in the form of;
Key - Value | Key - Value | Key - Value
Derek - 99.00 | Dave - 114.00 | Paul - 89.00
What I would like to do is, extract using a regex all keys and values into different field names.
The data I need to break out can have between 1 and 10 fields separated by the pipe "|" symbol.
Does anyone know of an elegant regex to pull these fields out? Obviously the pipe symbol is optional at the end of the fields, as I dont know when i've reached the end of the data.
NOTE: I cannot use mvindex (and/or split), as they are running way too slow for the data, so i'm trialling a Regex to speed things up.
So Far, I have this as a concept, but i'm feeling like it's not the best way to attack this.
((?[A-z.]+) - (?\d+.\d+)( | ))((?[A-z.]+) - (?\d+.\d+)( | ))
Any guiding light - much appreciated.
Or perhaps, to do it in the config files so that it won't clutter up your search query:
[your_sourcetype] REPORT-blah = pipedash
[pipedash] DELIMS = "|", "-"
The really long version on is also in the docs:
You could possibly use a regex pattern that would result in 2 mv fields - something like
... | rex field=origField "(?P<f1>\b[^-]+)\s-\s(?P<f2>\d+\.\d+)" max_match=10 | table origField f1 f2
You can use the
extract command. http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Extract
<your_search> | extract pairdelim=" | " kvdelim=" - "
This will pull your data into:
Derek=99.00 Dave=114.00 Paul=89.00