Splunk Search

Splitting one field into multiple fields

psomeshwar
Path Finder

Currently, I have a search that returns the following:

Search:

index=index1 sourcetype=sourcetype1 | table host, software{}

host                 software

hostname       cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
hostname       cpe:/a:vendor:product:version
                            ...
                            ...

Here, there are multiple software tied to one hostname, and the software is under one field called software{}. What I am looking for is a way to split the software field into 3 fields by extracting the vendor, the product and the version into 3 separate fields to return:

host                 software_vendor                   software_product             software_version

hostname       vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
hostname       vendor                                       product                                  version
                            ...
                            ...

Does anyone have any ideas?

Labels (5)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  I like to use rex.

| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  I like to use rex.

| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"

 

---
If this reply helps you, Karma would be appreciated.

psomeshwar
Path Finder

Thanks, this did help me, although now, a new problem arose. When I split the fields, they are not listed in the corresponding order. For example, here is how it was shown originally:

host                        software{}

hostname            cpe:/a:vendorA:product2:version3
                                 cpe:/a:vendorB:product3:version1
                                 cpe:/a:vendorC:product1:version2

 

With the new rex, it now looks like this:

hostname               software_vendor                 software_product              software_version

hostname               vendorA                                   product1                                 version1
                                    vendorB                                   product2                                 version2
                                    vendorC                                   product3                                  version3

Is there a way to keep the association between the vendor, product and version after the split?

0 Karma

psomeshwar
Path Finder

Never mind, this did not happen. Thanks for the solution!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...