Splunk Search

How do I replace '," with ";" between a bracket?

jianyu75074
New Member

I have raw data:

IMS,CSCF1,,,{REGISTER,19728881234@domain.com;user=phone,200},,{PUBLISH,19728881234@domain.com;user=phone,200}

I want the results as below. The field positions are fixed. Each interface field may present with value or not:

(null)
field1 is node type = "IMS"
field2 is node name = CSCF1
field3 is interface1 = null here
field4 is interface2 = null here
field5 is interface3 = "{REGISTER,19728881234@domain.com;user=phone,200}"
field6 is interface4 = null here
field7 is interface5 = "{PUBLISH,19728881234@domain.com;user=phone,200}"

I am going to do field extraction with delimiter ",". My problem is there is "," inside of interface field. If I can replace "," with ";" e.g. "{REGISTER;19728881234@domain.com;user=phone];200}", then I think I can delimit it.

So, my question is, how do I change my original data to:

IMS,CSCF1,,,{REGISTER;19728881234@domain.com;user=phone;200},,{PUBLISH;19728881234@domain.com;user=phone;200}

Or do you have a better suggestion? Thank you very much!

0 Karma

MousumiChowdhur
Contributor

Hi @jianyu75074 ,

You may use the below regex to extract the field values instead of using delimiter.

<your search> | rex "(?P<nodetype>\w+[^\,]+),(?P<nodename>\w+[^\,]+),(?P<interface1>[^\,]*),(?P<interface2>[^\,]*),(?P<interface3>\{.*?\}),(?P<interface4>[^\,]*),(?P<interfce5>\{.*?\})"

Thank You!

0 Karma

sdchakraborty
Contributor

Hi,
Can you try the below rex and see whether it resolves your query, I have given an example search too,

| makeresults 
| eval str = "IMS,CSCF1,,,{REGISTER,19728881234@domain.com;user=phone,200},,{PUBLISH,19728881234@domain.com;user=phone,200}"
| rex field=str "(?<node_type>\w*),(?<node_name>\w*),(?<interface1>{.*})?,(?<interface2>{.*})?,(?<interface3>{.*})?,(?<interface4>{.*})?,(?<interface5>{.*})?"

Sid

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...