Splunk - Split a field into multiple fields based on delimiters

0
votes

I have the following value in a field which needs to be split into multiple fields,

Classname:

abc.TestAutomation.NNNN.Specs.Prod/NDisableTransactionalAccessUsers.#()::TestAssembly:abc.TestAutomation

Required output:

Productname : abc.TestAutomation.NNNN.Specs.Prod

Feature name : NDisableTransactionalAccessUsers

Project : TestAssembly:abc.TestAutomation

I have been trying to extract the values into my fields using REX command, but I am failing.

source="Reports.csv"  index="prod_reports_data" sourcetype="ReportsData"  
| rex "classname(?<Productname>/*)\.(?<Featurename>#*)\.(?<Project>.*)" 
| table classname Productname Featurename Project

While I execute this command, there are no results. I am very new to Splunk, can someone guide.

Thanks.

1
regexsplunksplunk-query

1 Answers

0
votes

I almost always use multiple rex statement to get what I want ... but if you "know" the data is consistent, this will work (tried on regex101.com):

| rex field=_raw (?<classname>[^\/]+)\/(?<featurename>[^\.]+)\.[[:punct:]]+(?<project>[\w].+)

What this regular expression does:

  • <classname> :: everything from the front of the event to a front slash (/)
  • <featurename> :: whatever follows the front slash (/) until a literal dot (.)
  • discard all found punctuation
  • <project> :: whatever is left on the line

According to regex101.com, this is likely the most efficient rex you can use (14 steps total)