Search code examples
regexsplunksplunk-query

Splunk - Split a field into multiple fields based on delimiters


I have the following value in a field which needs to be split into multiple fields,

Classname:

abc.TestAutomation.NNNN.Specs.Prod/NDisableTransactionalAccessUsers.#()::TestAssembly:abc.TestAutomation

Required output:

Productname : abc.TestAutomation.NNNN.Specs.Prod

Feature name : NDisableTransactionalAccessUsers

Project : TestAssembly:abc.TestAutomation

I have been trying to extract the values into my fields using REX command, but I am failing.

source="Reports.csv"  index="prod_reports_data" sourcetype="ReportsData"  
| rex "classname(?<Productname>/*)\.(?<Featurename>#*)\.(?<Project>.*)" 
| table classname Productname Featurename Project

While I execute this command, there are no results. I am very new to Splunk, can someone guide.

Thanks.


Solution

  • I almost always use multiple rex statement to get what I want ... but if you "know" the data is consistent, this will work (tried on regex101.com):

    | rex field=_raw (?<classname>[^\/]+)\/(?<featurename>[^\.]+)\.[[:punct:]]+(?<project>[\w].+)
    

    What this regular expression does:

    • <classname> :: everything from the front of the event to a front slash (/)
    • <featurename> :: whatever follows the front slash (/) until a literal dot (.)
    • discard all found punctuation
    • <project> :: whatever is left on the line

    According to regex101.com, this is likely the most efficient rex you can use (14 steps total)