Splunk Search

Want to extract FOID= into two field, Pls help

jayavasge
New Member

05:45:25.985 [http-nio-8080-exec-137] INFO c.b.h.i.s.i.OrderDecompositionServiceImpl - POID=20275475 FOID=TRAFFIC_MGMT,43375717 FOID=CPE,43375719 FOID=RADIUS,43375721 FOID=WCLI,43375723

Tags (1)
0 Karma

woodcock
Esteemed Legend

Either this:

... | rex mode=sed "s/^.*?FOID//"
| rex max_match=0 "=(?<Type>[^,]+),(?<Number>\d+)"

OR this:

... | rex mode=sed "s/^.*? - //g s/FOID=//g s/,/=/g"
| kv
0 Karma

vinod94
Contributor

Hi @jayavasge ,

You can try this ...

Your search | rex max_match=0 "FOID\=(?P<type1>[^\,]+)\,(?P<number1>[^\s]+)" 
| eval zipped= mvzip(type1,number1,"!!!!!number1=") 
| mvexpand zipped 
| fields _time zipped 
| mvexpand zipped 
| rex field=zipped "^(?P<Type>.*)!!!!!number1\=(?P<Number>\d+)"
|table  Type Number

for example ,
this is a run anywhere search

| makeresults 
| eval data="05:45:25.985 [http-nio-8080-exec-137] INFO c.b.h.i.s.i.OrderDecompositionServiceImpl - POID=20275475 FOID=TRAFFIC_MGMT,43375717 FOID=CPE,43375719 FOID=RADIUS,43375721 FOID=WCLI,43375723" 
| rename data as _raw 
| rex max_match=0 "FOID\=(?P<type1>[^\,]+)\,(?P<number1>[^\s]+)" 
| eval zipped= mvzip(type1,number1,"!!!!!number1=") 
| mvexpand zipped 
| fields _time zipped 
| mvexpand zipped 
| rex field=zipped "^(?P<Type>.*)!!!!!number1\=(?P<Number>\d+)"
|table  Type Number

let me know if this works...

0 Karma

sudosplunk
Motivator

Hi there, can you let me know what is expected output?

0 Karma

jayavasge
New Member

Type Number
TRAFFIC_MGMT 43375717
CPE 43375719
RADIUS 43375721
WCLI 43375723

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...