All Apps and Add-ons

Exclusion of Delimiter in special condition

nina15
Communicator

I am using a search-time field extraction with transform being used.
the events only contain values -no field names- and they are all separated by commas which makes me able to use DELIMS and FIELDS in transform.conf.
My problem is though that for some special conditions I want splunk to skip the comma, like if there is a backslash after the comma, I want it to gather up all the previous and next characters as one field.

for example, if the event is:

AAA,BBB,CCC,/CCC,DDD

splunk will create:

field1 = AAA
field2 = BBB
field3 = CCC
field4 = /CCC
field5 = DDD

but I want the fields to be:

field1 = AAA
field2 = BBB
field3 = CCC,/CCC
field4 = DDD

how can I achieve that?

0 Karma

cbs01
Engager

While I don't have a play system available to try this, wouldn't you be able to define field3 something like:

(?\w{3}),(?\w{3}),(?\w{3}(,/\w{3}){0,1}),(?\w{3})

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...