instr in Splunk ?

[kp_pl]

Below is one of my fields. Quite complex,  I know It could be divided to more atomic values .. but it is not 😞

[AuditingPipelinePair, AuditingPipelinePair_response, AuditResponse, RESPONSE] [[
Tag = AUDIT-SUCCESS
Subject = "TAR_ID":"72503", "YEAR":"2106", "EQ_TY":"STD"
BXB ServiceTus TransactionId = sb-W10nXQte_ORf6PjJ4wQ#000000004
Message ID = afa9613.62eeaf42.N6b.1405404bdw7.N7e14
Service Ref = KlmSpsDictanaryS1/proxy/KlmSpsDictanary
Operation = getShareEquip
Protocol = KTTP
Client Address = 11.232.189.10
TransportDevel User = <anonymous>
MessageDevel User = dkd
Message Pode = 0
Payload = Dipis sb-W10wXDte_ORf6PjJde34wQ0004
]]

Anyway, some of (single Strings) values splunk separated automatically like Protocol or Operation. But how to extract (or even eval in query) parameter with space like  "MessageDevel User"  or "ClientAddress" ?

[glc_slash_it]

Not quite sure what you're asking but, there are several things you can do there:

If fields like "Client Address" are not extracted, you can do a rex command and then use the extracted fields in evals etc:

| rex "Client Address = (?<address>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| eval address = ...

If they are already extracted, but the field as a space you can do either:

| rename "Client Address" as ClientAddress
|eval ClientAddress = ...
or
| eval "Client Address" = ...

[ITWhisperer · Accepted solution]

You could use rex, something like this

| rex "MessageDevel User = (?<MessageDevelUser>\S+)"

[kp_pl]

Would you look at Payload parameter. Result has many strings with spaces.

[kp_pl]

I feel it could be a good solution but how to use it ?  Should I extract new field with this regex ? 

[kp_pl]

ok, got it !  Works perfect 🙂