Splunk Search

Split merged events

zoebanning
Path Finder

Hello Splunk Community, 

 

I have a merged event which shows if a service is running or down. Here is an example of the event in splunk:

 

******************************************************************************* All services are running

1092827|default|service1is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************

 

How can I split the merged events so I can extract the service name, status (running/down) & host?

16272373|default|service3 is running

Host |      | ServiceName is Status

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do it.  

| makeresults | eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
```The above just defines test data```
```Copy the raw event because we can't split _raw.```
| eval data=_raw
```Divide the event into lines```
| eval data=split(data,"
")
```Create one event for each line```
| mvexpand data
```Put _raw back```.
| eval _raw=data
```Filter out "****" and blank lines```
| regex "^\d"
```Extract host, service, and status fields```
| rex "(?<Host>\d+)\|\w+\|(?<service>\S+) is (?<status>\S+)"
```Display the fields```
| table Host service status
---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can run this example

| makeresults
| eval _raw="******************************************************************************* All services are running

1092827|default|service1 is running

37238191|default|service2 is running

16272373|default|service3 is running

*******************************************************************************"
| rex max_match=0 "(?<event>\d+\|default\|.*)"
| mvexpand event
| table event
| rex field=event "(?<host>\d+)\|default\|(?<service>\w+)\sis\s(?<status>.*)"
| table host service status

It shows you a way to extract the original event from the multiline merged data and then to expand those to individual events. The second rex then extracts those fields.

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...