splunk - Split field based on length in the field - Stack Overflow

admin管理员组

文章数量:1352205

Given an event with a field that contains multiple values:

001003012002003xyz...

where each has the format

iiilllvvvvvv...

Where

• i=3-digit id
• l=3-digit length
• v=alphanumeric value of the length specified

I'd like to split this in Splunk such that I can apply logic like "event contains an id of 13" or "id 29 has a value of 'abc123'", etc.

Regular expressions do not seem to work here. Backreferences are not supported in reference counts, so something like (?<id>\d{3})(?<length>\d{3})(?<value>.{1,\<length>}) will not work.

I also tried all the eval functions in Splunk, but none of them seem to be able to split strings on anything other than regular expressions or fixed indexes, neither of which work here.

Given an event with a field that contains multiple values:

001003012002003xyz...

where each has the format

iiilllvvvvvv...

Where

• i=3-digit id
• l=3-digit length
• v=alphanumeric value of the length specified

I'd like to split this in Splunk such that I can apply logic like "event contains an id of 13" or "id 29 has a value of 'abc123'", etc.

Regular expressions do not seem to work here. Backreferences are not supported in reference counts, so something like (?<id>\d{3})(?<length>\d{3})(?<value>.{1,\<length>}) will not work.

I also tried all the eval functions in Splunk, but none of them seem to be able to split strings on anything other than regular expressions or fixed indexes, neither of which work here.

• splunk
• splunk-query

Share Improve this question Follow edited Apr 1 at 3:32 Andrew Morris asked Apr 1 at 3:23 Andrew MorrisAndrew Morris 1122 bronze badges New contributor Andrew Morris is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. 1

• What about substr()? See if this helps any: community.splunk/t5/Splunk-Search/… – PM 77-1 Commented Apr 1 at 18:58

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Something like below:

| makeresults
| eval _raw="123005dfghyujikol;"
``` the above is test data ```
``` below the actual query ```
| rex (?<id>\d{3})(?<lng>\d{3})(?<therest>.*)
| eval value=substr(therest, 1, lng)

(Hopefully no typos)

本文标签： splunkSplit field based on length in the fieldStack Overflow