Splunk Search

Need help splitting a single fields values into multiple chunks based on the length.

mjones414
Contributor

I have a situation where I have a multi-value field that can contain anywhere from 1 to 2000 or more values in a day.  each value is exactly 38 characters long.  Each 38 character string is a GUID for another application, and that application can only accept up to 1000 characters at a time.  What I'd like to do is chunk the strings together in complete blocks of 20 which would be 760 characters per block, and then call them by mvindex, but I haven't figured out how to do this in eval so that it will create it whether I have 1 string, 23 strings, or 900 strings to evaluate, since that is always going to be the unknown variable.  Any assistance on how to solve this would be very helpful.


 

 

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming guid doesn't contain commas, and you don't hit some sort of limit on string size (from the mvjoin), you could try something like this

| eval guids=mvjoin(guid,",")
| rex field=guids max_match=0 "(?<group>([^,]+,){1,20}[^,]+)"

mjones414
Contributor

Brilliance!  Sheer Brilliance! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...