Splunk Search

Split merged events

zoebanning
Path Finder

Hello Splunk Community, 

 

I have a merged event which shows if a service is running or down. Here is an example of the event in splunk:

 

******************************************************************************* All services are running

1092827|default|service1is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************

 

How can I split the merged events so I can extract the service name, status (running/down) & host?

16272373|default|service3 is running

Host |      | ServiceName is Status

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do it.  

| makeresults | eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
```The above just defines test data```
```Copy the raw event because we can't split _raw.```
| eval data=_raw
```Divide the event into lines```
| eval data=split(data,"
")
```Create one event for each line```
| mvexpand data
```Put _raw back```.
| eval _raw=data
```Filter out "****" and blank lines```
| regex "^\d"
```Extract host, service, and status fields```
| rex "(?<Host>\d+)\|\w+\|(?<service>\S+) is (?<status>\S+)"
```Display the fields```
| table Host service status
---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can run this example

| makeresults
| eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
| rex max_match=0 "(?<event>\d+\|default\|.*)"
| mvexpand event
| table event
| rex field=event "(?<host>\d+)\|default\|(?<service>\w+)\sis\s(?<status>.*)"
| table host service status

It shows you a way to extract the original event from the multiline merged data and then to expand those to individual events. The second rex then extracts those fields.

 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...