Split semicolon separated event into many events

[starbac]

Hello every one,

I have some data in Splunk server that is separated by semicolon ";"
String1=Int1;String2=Int2;String3=Int3...

I want to split this data into lines and get only the list of strings. Below a sample of what I want to get:
String1
String2
String3
...

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval msg="String1=Int1;String2=Int2;String3=Int3" 
| makemv delim=";" msg 
| mvexpand msg
| rex field=msg "(?P<name>^[^=]+)"

OR

| makeresults 
| eval msg="String1=Int1;String2=Int2;String3=Int3" 
| eval temp= split(msg,";") 
| mvexpand temp 
| eval result = mvindex(split(temp,"="),0)

[starbac]

Nope, it doesn't change anything in my results (And yes, I have replaced msg with _raw)

[vnravikumar]

if possible can you post your query. In which field it contains the above said data

[starbac]

index=index_name sourcetype="sourcetype_name" some_pattern_to_match | eval msg=_raw
| eval temp= split(msg,";")
| mvexpand temp
| eval result = mvindex(split(temp,"="),0)

[vnravikumar]

If possible can you post some sample events?

[starbac]

jboss-server-prd;jms-queues;queue1=0;queue2=0;queue3=0

[kamlesh_vaghela]

Expected?

[vnravikumar]

try like

| makeresults 
 | eval msg="jboss-server-prd;jms-queues;queue1=0;queue2=0;queue3=0" 
 | rex max_match=0 field=msg "(?P<result>\w+)\=" |mvexpand result

[starbac]

Works, thanks !

[starbac]

But I have one problem with it, I have a queue named "active.queue1=0", with your query I get only queue1, do you know how to fix it please ?

[vnravikumar]

Hi

Try this and let me know

| makeresults 
| eval msg="jboss-server-prd;jms-queues;active.queue1=0;queue2=0;queue3=0" 
| eval temp=split(msg,";") 
| mvexpand temp 
| regex temp="(\=)" 
| eval result = mvindex(split(temp,"="),0)

[starbac]

Great, it works thanks

[starbac]

queue1

queue2

queue3

All I want to get is an event for each queue