reportsplunksplunk-querysplunk-sdksplunk-dashboard

Generate Splunk report with only extracted fields

First and foremost, maybe what I am looking for isn’t possible or I am going down the wrong path. Please suggest.

Consider, I’ve raw data which has n number of parameters each separated by ‘&’.

Id=1234&ACC=bc3gds5&X=TESTX&Y=456567&Z=4457656&M=TESTM&N=TESTN&P=5ec3a

Using SPL, I’ve filtered only a few fields(ACC, X, Y) which I’m interested in. Now, I would like to generate the report only with the filtered fields in a tabular format, not the whole raw data.

Solution

  • There may be more than one way to do that, but I like to use rex. The rex command extracts text that matches a regular expression into fields. Once you have the fields you use SPL on them to do whatever you need.

    index=foo
| rex "ACC=(?<ACC>[^&]+)&X=(?<X>[^&]+)&Y=(?<Y>[^&]+)"
| table ACC X Y