Splunk Search

Split square bracket expression: How to separate out below fields in table format?

drogo
Explorer

Hi,

I want to separate out below fields in table format.

Raw = Namespace [com.sampple.ne.vas.events], ServiceName [flp-eg-cg], Version [0.0.1], isActive [true], AppliationType [EVENT]

Query I am using =
| eval Namespace=mvindex(split(mvindex(split(_raw, "Namespace "),1),"],"),1)
| eval ServiceName=mvindex(split(mvindex(split(_raw,"ServiceName "),1),"],"),0)
| eval Version=mvindex(split(mvindex(split(_raw,"Version "),1),"],"),0)
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version

Expected result

Host AppName ServiceName Version
       
       



 

Labels (2)
0 Karma

drogo
Explorer

@hanks @richgalloway this help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<keyvalue>\w+\s\[[^\]]+)"
| mvexpand keyvalue
| rex field=keyvalue "(?<key>\w+)\s\[(?<value>[^\]]+)"
| eval {key}=value
| fields - keyvalue key value
| stats values(*) as * by _raw

drogo
Explorer

Thanks @ITWhisperer 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what results your query returned and why those results aren't good enough.

I prefer the rex command for extracting fields.  The regular expressions below look for the given keyword then extract what's between the following square brackets.

| rex "Namespace \[(?<Namespace>[^\]]+)"
| rex "ServiceName \[(?<ServiceName>[^\]]+)"
| rex "Version \[(?<Version>[^\]]+)"
| stats latest(Namespace) as Namespace latest(ServiceName) as ServiceName latest(Version) as Version by host
| sort -Version

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...