Hi,
I need to find the value of PLANDATA_TYPE from the given string in my logs
i.e. PLANDATA_TYPE: ASBFGH, PLANWORK: NotMentioned.
I should get output as ASBFGH when I search for value of PLANDATA_TYPE.
And similarly I should get value as NotMentioned for PLANWORK. The issue is they are not separated by "=" sign but by ":". Any ideas how to proceed?
Use an extract. Try:
… | rex field=_raw "PLANDATA_TYPE:\s(?<PLANDATA_TYPE>\w+),\sPLANWORK:(?<PLANWORK>\w+)"
If you can edit the props / transforms directly, this would work just fine with the following transform on your data:
[my_rule]
DELIMS = ":", ","
The first signifies what separates a key from a value, and the second indicates what separates key=value pairs from each other.
Use an extract. Try:
… | rex field=_raw "PLANDATA_TYPE:\s(?<PLANDATA_TYPE>\w+),\sPLANWORK:(?<PLANWORK>\w+)"
Thanks jtrucks and dolxor. It worked..!!!
fixed. Nice call 🙂
Hey jtrucks. Shouldn't there be a whitespace \s between the : and (?<.. or does Splunk trim this automatically when assigning the value to the fieldname?