All Apps and Add-ons

In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

prateedshetty
Path Finder

Also if the company name were 'Company=Apple+Banana', how can I ignore the + to make the Company name look like Apple Banana once added in the dashboard.

Final Result should be:
Company
A&B Example
Apple Banana

How I see it now
Company
A
Apple+Banana

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

View solution in original post

0 Karma

prateedshetty
Path Finder

This worked

sourcetype=abc| rex field=Company mode=sed "y/+/ /" |stats count by Company

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

0 Karma

prateedshetty
Path Finder

I just tried the below query to replace + with space.

sourcetype=abc "https://www.abc.com" | rex field=Company mode=sed "s/+/ /g" | Top Company

and I get --> Error in 'rex' command: Regex: quantifier does not follow a repeatable item

0 Karma

prateedshetty
Path Finder

This just worked though..

............| rex field=Company mode=sed "y/+/ /" |.......

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Good. glad you got it handled.

If that's all you needed, then please accept the answer so the question will show as closed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...