Splunk Search

How to Parse Results?

jfolland
New Member

I am interested in seeing only pieces of a message in the results. I would like to be able to run a search and return only a substring of the message. In sql, it would be something like "substring(message, charindex(message, 'somestringvalue'), somelength)" and thus my results would only contain the information I was interested in.

Is there a way to do this?

Tags (1)
0 Karma

mw
Splunk Employee
Splunk Employee

The answer can also depend on what you mean by substring. For presentation purposes, there are generally better mechanisms to carve up the raw data. If the relevant data is in fields then you can "table" them as well. Depending on the purpose, this can be prettier to look at:

fail* sourcetype=syslog | table pid, process
0 Karma

ziegfried
Influencer

Probably the most straight-forward way to do this is to use a regular expression. It's quite easy to translate such a substring expression to regex. In order to see the altered message, you have to change the content of the _raw field.

eg.

substring(message, charindex(message, "foo"), 20)

would be translated as

sourcetype=mysourcetype | rex "(?<_raw>foo.{17})"

You can as well use the eval command to extract substrings, but there's no charindex equivalent available:

sourcetype=mysourcetype | eval _raw=substr(_raw, 5, 25)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...