Splunk Search

how can I do field substitution

gbiju
New Member

I have a multi value field as ns=n1,n2,n3 and n1,n2,n3 are also fields by themselves like
n1=abc, n2=pqr, n3=xyz

Using field ns, i need to somehow retrieve/display abc,pqr,xyz. Any solutions?

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for something like this?

| stats count | eval _raw = "<SOAP-ENV:Body><ns1:getCustInfo xmlns:ns1=\"http://provider.company.com/getCustInfo_v3\"></SOAP-ENV:Body>"
| rex "\<(?<ns>[^:]+):getCustInfo" | eval custInfoNs = replace(_raw, "^.*?xmlns:".ns."=\"([^\"]+).*$", "\1")

That'll create a field called custInfoNs that will contain http://provider.company.com/getCustInfo_v3.

The issue is that rex doesn't allow the use of existing fields when building the regular expression, so the detour through replace() is needed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That sounds a lot like one of the quantifiers in the regex being too greedy. Do you have a short enough example to post here that still fails?

0 Karma

gbiju
New Member

Thanks Martin for the answer. It works perfectly in this isolated case scenario. But when I try it against a larger real world soap xml, where there are lot of namespaces, it doesnt work. I get the full xml in the field.

0 Karma

gbiju
New Member

i want to extract the namespace value of a soap message call.
Eg:

<SOAP-ENV:Body><ns1:getCustInfo xmlns:ns1=http://provider.company.com/getCustInfo_v3>
</SOAP-ENV:Body>

Since the same call comes from different clients, the ns1 is not fixed. In some messages, it will be ns5, ns14 etc mapping to the same namespace so the message is valid. I am able to put a rex to get the value prefixed before getCustInfo into a field ns, but using that I need to get 'http://provider.company.com/getCustInfo_v3'

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Please describe the actual use case rather than a proposed solution to an unknown use case.

Maybe there's a much simpler way to achieve the same goal.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...