Given an event with a field that contains multiple values:
001003012002003xyz...
where each has the format
iiilllvvvvvv...
Where
i=3-digit idl=3-digit lengthv=alphanumeric value of the length specified
I'd like to split this in Splunk such that I can apply logic like "event contains an id of 13" or "id 29 has a value of 'abc123'", etc.
Regular expressions do not seem to work here. Backreferences are not supported in reference counts, so something like (?<id>\d{3})(?<length>\d{3})(?<value>.{1,\<length>}) will not work.
I also tried all the eval functions in Splunk, but none of them seem to be able to split strings on anything other than regular expressions or fixed indexes, neither of which work here.
Given an event with a field that contains multiple values:
001003012002003xyz...
where each has the format
iiilllvvvvvv...
Where
i=3-digit idl=3-digit lengthv=alphanumeric value of the length specified
I'd like to split this in Splunk such that I can apply logic like "event contains an id of 13" or "id 29 has a value of 'abc123'", etc.
Regular expressions do not seem to work here. Backreferences are not supported in reference counts, so something like (?<id>\d{3})(?<length>\d{3})(?<value>.{1,\<length>}) will not work.
I also tried all the eval functions in Splunk, but none of them seem to be able to split strings on anything other than regular expressions or fixed indexes, neither of which work here.
Share Improve this question edited Apr 1 at 3:32 Andrew Morris asked Apr 1 at 3:23 Andrew MorrisAndrew Morris 112 bronze badges New contributor Andrew Morris is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. 1 |1 Answer
Reset to default 0Something like below:
| makeresults
| eval _raw="123005dfghyujikol;"
``` the above is test data ```
``` below the actual query ```
| rex (?<id>\d{3})(?<lng>\d{3})(?<therest>.*)
| eval value=substr(therest, 1, lng)
(Hopefully no typos)
substr()? See if this helps any: community.splunk/t5/Splunk-Search/… – PM 77-1 Commented Apr 1 at 18:58