Splunk Search

erex or IFE with comma

tb5821
Communicator

How do I use the IFA or even better erex and specify mutiple values that contain a comma? I've tried putting them in quotes etc but doesn't seem to work.

I really just trying to extract a date from our logs which starts with the year and ends in 00

Tags (2)
0 Karma

lguinn2
Legend

When doing field extraction, Splunk may look at fields containing commas as "multi-valued" fields - or not, depending on your configuration.

erex might not be a good choice for dealing with this, because it uses commas to separate the sample values. For the example that @garywiner provided, this will work

yoursearchhere
| rex field=_raw "Name=(?<lastname>.+?)\,(?<firstname>.+?)\;"

This creates two fields, lastname and firstname... You could use a similar regular expression in a props.conf EXTRACT to make these fields permanent.

0 Karma

lguinn2
Legend

Can you post an example of the data that you are working with - and how the field should be extracted? I think this would be easier with a concrete example.

BTW, I think you mean the IFX (Interactive Field Extractor).

0 Karma

garywiner
New Member

Same question, but something even simpler. The field contains "lastname,firstname".
Name=IDAHO,DUNCAN;
Name=JONES,JOHN;

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...