Splunk Search

Need help splitting a single fields values into multiple chunks based on the length.

mjones414
Contributor

I have a situation where I have a multi-value field that can contain anywhere from 1 to 2000 or more values in a day.  each value is exactly 38 characters long.  Each 38 character string is a GUID for another application, and that application can only accept up to 1000 characters at a time.  What I'd like to do is chunk the strings together in complete blocks of 20 which would be 760 characters per block, and then call them by mvindex, but I haven't figured out how to do this in eval so that it will create it whether I have 1 string, 23 strings, or 900 strings to evaluate, since that is always going to be the unknown variable.  Any assistance on how to solve this would be very helpful.


 

 

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

mjones414
Contributor

Brilliance!  Sheer Brilliance! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...