Splunk Search

How to split delimited log, extract a field and group by the value

rmalghan
Explorer

Hi: I have logs that is delimited by ||. I would like to extract nth value from each log and group them by value and count.  I am fairly new to Splunk. This is how far I have gotten. 

 

 

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| <WHAT DO I NEED HERE>
| stats count by <field_value>
| sort -count

 

 

My data

 

 

INSERT||"test Identifier"||"hostname"||"192.168.2.1"||"This is a test log"||....

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

mvindex will allow you to select each of the multi-values

| makeresults
| eval _raw="INSERT||\"test Identifier\"||\"hostname\"||\"192.168.2.1\"||\"This is a test log\"||...."
| eval fields=split(_raw,"||")
| eval field0=mvindex(fields,0)
| eval field1=mvindex(fields,1)
| eval field2=mvindex(fields,2)
| eval field3=mvindex(fields,3)

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...