Splunk Search

Splitting one field into multiple fields

psomeshwar
Path Finder

Currently, I have a search that returns the following:

Search:

index=index1 sourcetype=sourcetype1 | table host, software{}

host                 software

hostname       cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
                            cpe:/a:vendor:product:version
hostname       cpe:/a:vendor:product:version
                            ...
                            ...

Here, there are multiple software tied to one hostname, and the software is under one field called software{}. What I am looking for is a way to split the software field into 3 fields by extracting the vendor, the product and the version into 3 separate fields to return:

host                 software_vendor                   software_product             software_version

hostname       vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
                            vendor                                       product                                  version
hostname       vendor                                       product                                  version
                            ...
                            ...

Does anyone have any ideas?

Labels (5)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  I like to use rex.

| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  I like to use rex.

| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"

 

---
If this reply helps you, Karma would be appreciated.

psomeshwar
Path Finder

Thanks, this did help me, although now, a new problem arose. When I split the fields, they are not listed in the corresponding order. For example, here is how it was shown originally:

host                        software{}

hostname            cpe:/a:vendorA:product2:version3
                                 cpe:/a:vendorB:product3:version1
                                 cpe:/a:vendorC:product1:version2

 

With the new rex, it now looks like this:

hostname               software_vendor                 software_product              software_version

hostname               vendorA                                   product1                                 version1
                                    vendorB                                   product2                                 version2
                                    vendorC                                   product3                                  version3

Is there a way to keep the association between the vendor, product and version after the split?

0 Karma

psomeshwar
Path Finder

Never mind, this did not happen. Thanks for the solution!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...