Splunk Search

How to extract, convert and show data

Sentira
Explorer

I have following data and :

......
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[10202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[00202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"
.....


I need to extract the "First_Status" and "Second_Status"  of a Chute and the field from log data and each 2 characters of value belongs to one Item. 
Example: first character set "20",  2 is  for First_Status and means OK and 0 is for Second_Status and means NOT OK for Item_1.  (Total Items= 128/2 = 64)
Finally I want to extract the raw data and convert to First_Status , Second_Status and link them to a fix Item
(Item_1...Item_64):

_timeItemsFirst_StatusSecond_Status
2021-06-18 21:05:45.037Item_1OkOk
2021-06-18 21:05:46.037Item_1Not OkNot Ok
2021-06-18 21:05:47.037Item_2OkOk
2021-06-18 21:05:49.037Item_n.........

....

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]"


| rex "ChuteAndStatus=\[(?<ChuteAndStatus>[^\]]+)"
| rex max_match=0 field=ChuteAndStatus "(?<ChuteAndStatus>\d\d)"
| streamstats count as row 
| mvexpand ChuteAndStatus
| streamstats count as item by row
| eval item="item_".item
| eval First_Status=substr(ChuteAndStatus,1,1)
| eval Second_Status=substr(ChuteAndStatus,2,1)
| eval First_Status=case(First_Status==0,"Not OK",First_Status==1,"OK",First_Status=2,"Not Known")
| eval Second_Status=case(Second_Status==0,"Not OK",Second_Status==1,"OK",Second_Status=2,"Not Known")
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...