Splunk Search

how to split string in splunk

Khushboo
Explorer

Hi @all,

 

i have following string which i want to break into there fields: service_name, host and port_id

metics-ha-5924590-011.aba.corp.tyos.com:2002

service_name = metics

host = ha-5924590-011.aba.corp.tyos.com

port = 2002
anyone please help me, how can i do it in splunk query.

Thanks !!

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Khushboo,

you have to define a rule to extract fields:

if you cadn define that:

  • from the beginning to the first "-" it's the "service_name",
  • from the service_name to ":" it's the host,
  • after there's the port;

this regex can work.

In other words if you can define a rule, you can use a regex otherwise you cannot!

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Khushboo,

Please, try this regex:

| rex "(?<service_name>[^-]+)-(?<host>[^:]+):(?<port>\d+)"

tha you can test at https://regex101.com/r/wkUHCx/1

Ciao.

Giuseppe

Khushboo
Explorer

Hi @gcusello ,

Thanks for your reply.
In my case all the variables like service_name, host and port are dynamic. so i cant hard-coded that.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Khushboo,

you have to define a rule to extract fields:

if you cadn define that:

  • from the beginning to the first "-" it's the "service_name",
  • from the service_name to ":" it's the host,
  • after there's the port;

this regex can work.

In other words if you can define a rule, you can use a regex otherwise you cannot!

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...