Splunk Search

Split a single field into two fields

Allampally
Path Finder

Hi,

I have a raw_data as below
[APP=XYZ] [m=ServiceName.MethodName] [SLA=100]
Splunk already generated a filed with the name 'm".
I want to split this field into two separate fields(m1 & m2) as below
m1=ServiceName
m2=MethodName

Could anyone help me to do so ?

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

without knowing what the data actually looks like, you could try this in the search string:

|rex field=m "(?<m1>.*)\.(?<m2>.*)"

if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions

View solution in original post

cmerriman
Super Champion

without knowing what the data actually looks like, you could try this in the search string:

|rex field=m "(?<m1>.*)\.(?<m2>.*)"

if you would like this to be automatically extracted, you could add the extraction if you are an admin. look over this doc:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Managesearch-timefieldextractions

Allampally
Path Finder

Thank you cmerriman :). It worked for me

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...