All Apps and Add-ons

Exclusion of Delimiter in special condition

nina15
Communicator

I am using a search-time field extraction with transform being used.
the events only contain values -no field names- and they are all separated by commas which makes me able to use DELIMS and FIELDS in transform.conf.
My problem is though that for some special conditions I want splunk to skip the comma, like if there is a backslash after the comma, I want it to gather up all the previous and next characters as one field.

for example, if the event is:

AAA,BBB,CCC,/CCC,DDD

splunk will create:

field1 = AAA
field2 = BBB
field3 = CCC
field4 = /CCC
field5 = DDD

but I want the fields to be:

field1 = AAA
field2 = BBB
field3 = CCC,/CCC
field4 = DDD

how can I achieve that?

0 Karma

cbs01
Engager

While I don't have a play system available to try this, wouldn't you be able to define field3 something like:

(?\w{3}),(?\w{3}),(?\w{3}(,/\w{3}){0,1}),(?\w{3})

Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...