Splunk Search

How to split delimited log, extract a field and group by the value

rmalghan
Explorer

Hi: I have logs that is delimited by ||. I would like to extract nth value from each log and group them by value and count.  I am fairly new to Splunk. This is how far I have gotten. 

 

 

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| <WHAT DO I NEED HERE>
| stats count by <field_value>
| sort -count

 

 

My data

 

 

INSERT||"test Identifier"||"hostname"||"192.168.2.1"||"This is a test log"||....

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

mvindex will allow you to select each of the multi-values

| makeresults
| eval _raw="INSERT||\"test Identifier\"||\"hostname\"||\"192.168.2.1\"||\"This is a test log\"||...."
| eval fields=split(_raw,"||")
| eval field0=mvindex(fields,0)
| eval field1=mvindex(fields,1)
| eval field2=mvindex(fields,2)
| eval field3=mvindex(fields,3)

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

you have to use the rex command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex), using your sample, if you want to extract the third fieldsomething like this:

index=<index> INSERT OR UPDATE 
| eval fields=split(_raw,"||") 
| rex "^([^\|]+\|\|){3}\"(?<extracted_field>[^\"]+)"
| stats count by extracted_field
| sort -count

you can test the regex at https://regex101.com/r/N7KpU3/1

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rmalghan,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...