Splunk® Data Stream Processor

Function Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

String manipulation

concat(values)

Combines string values. This function accepts a variable number of arguments.

Function Input
values: collection<string>
Function Output
string

1. SPL2 example

Returns Jane A Smith in the host field.

...| eval host=concat("Jane", " ", "A", " ", "Smith");

2. SPL2 example

Prepends "asa_" to the value of "source_type".

...| eval source_type=concat("asa_", "source_type");

3. SPL2 example

Alternatively, you can use named arguments. See SPL2 syntax for more details.

...| eval host=concat(values: ["Jane", " ", "A", " ", "Smith"]);

extract_grok(input, pattern)

Extracts matching groups with a Grok-compatible pattern and returns a map of group names to matching groups when the pattern is matched against the input. It returns null if the input is null or the pattern is invalid.

Function Input
input: string
pattern: string
Function Output
map<string, string>

SPL2 examples

Returns "IPV4": "10.10.10.10" in ip_address.

... | eval ip_address=extract_grok("FOO 10.10.10.10 BAR", "%{IPV4}");

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

... | eval ip_address=extract_grok(pattern: "%{IPV4}", input: "FOO 10.10.10.10 BAR");


extract_key_value(input, key_value_delimiter, pair_delimiter)

Extracts the key-value pairs and returns a map of the key-value pairs. The keys and values are separated with a key value delimiter, and pairs are separated with a pair delimiter. It returns null if the input is null or the key value delimiter is null or empty.

Function Input
input: string
key_value_delimiter: string
pair_delimiter: string
Function Output
map<string, string>

1. SPL2 example

Returns {"key1":"value1","key2":"value2","key3":"value3"}.

| eval n=extract_key_value("key1=value1;key2=value2;key3=value3", "=", ";");

2. SPL2 example

Extracts key-value pairs from body.

...| eval extracted_body=extract_key_value(cast(body, "string"), "=", " ");

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

| eval n=extract_key_value(key_value_delimiter: "=", pair_delimiter: ";", input: "key1=value1;key2=value2;key3=value3");

extract_regex(input, pattern)

Extracts capturing groups from inputs with regular expressions and returns a map of all extracted, matched fields in the format: {"capture_group_1": "matching_expression_1", "capture_group_N":"matching_expression_N"}. If you do not name the capturing group, the group names are returned as "1", "2", "3", "N", etc. For example, extract_regex with the regex (?<host>[^\.]+) returns a map with the key host whose value is the value of the extracted capture group. For a non-named capture group, extract_regex with the regex ([^\.]+) will return a map with key 1 whose value is the value of the extracted capture group. To name your capturing group, start your regular expression pattern with ?<capturing-group-name>, as shown in the SPL2 examples. Use this function if you want your extracted data to be nested in a single field.

Function Input
input: string
pattern: regular expression pattern
Function Output
map<string, string>

1. SPL2 example

Extracts ASA-x-xxxxxx values from the body field using a named capturing group.

...| eval asa=extract_regex(cast(body, "string"), /(?<ASA>ASA-\d-\d{6})/i);

2. SPL2 example

Extracts a six digit number from value and places that value in the field numbers.

...| select extract_regex(to_string(value), /\d{6}/) AS numbers;

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval asa=extract_regex(pattern: /(?<ASA>ASA-\d-\d{6})/i, input: cast(body, "string"));

len(str)

Returns the character length of a string str.

Function Input
str: string
Function Output
integer

SPL2 examples

Filters records by source character limit.

...| where 6=len(source);

Alternatively, you can use named arguments. See SPL2 syntax for more details.

...| where 6=len(str: source);

lower(str)

Converts a string to lowercase.

Function Input
str: string
Function Output
string

SPL2 examples

Filters records by source bar.

...| where source=lower("BAR");

Alternatively, you can use named arguments. See SPL2 syntax for more details.

...| where source=lower(str: "BAR");

ltrim(str, strip_chars)

This function takes two arguments. The required argument is str, a string. This function also takes an optional argument strip_chars, also a string. This function returns either str with whitespaces removed from the left side or str with the characters in strip_chars trimmed from the left side.

Function Input
str: string
(Optional) strip_chars: string
Function Output
string

1. SPL2 example

Returns "abcZZ ".

...| eval n=ltrim(" ZZZZabcZZ ", " Z");

2. SPL2 example

Returns "abc ".

...| eval n=ltrim(" abc ");

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval n=ltrim(strip_chars: " Z", str: " ZZZZabcZZ ");


match_regex(input, pattern)

Matches inputs against regular expressions and returns true if the pattern matches against the input, otherwise it returns False.

Function Input
input: string
pattern: regular expression pattern
Function Output
boolean

SPL2 examples

Filters records that contain an ASA number in body.

...| where match_regex(cast(body, "string"), /%ASA-\d-\d{6}/);

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| where match_regex(pattern: /%ASA-\d-\d{6}/, input: cast(body, "string"));


match_wildcard(input, pattern)

Matches inputs against a pattern with wildcards. Returns true on a successful match, otherwise it returns false.

Function Input
input: string
pattern: string
Function Output
boolean

SPL2 examples

Returns true in sensitive_info when Credit:* is in the body field.

...| eval sensitive_info=match_wildcard(cast(body, "string"), "Credit*");

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval sensitive_info=match_wildcard(pattern: "Credit*", input: cast(body, "string"));

replace(str, pattern, rep)

This function returns a string formed by substituting string rep for every occurrence of regex string pattern in string str. The third argument rep can also reference groups that are matched in the regex.

Function Input
str: string
pattern: regular expression pattern
rep: string
Function Output
string

1. SPL2 example

Returns the body field with phone numbers redacted.

...| eval body=replace(cast(body, "string"), /[0-9]{3}[-.][0-9]{3}[-.][0-9]{4}/, "<redacted>");

2. SPL2 example

This example uses a capture group to format the replacement string. The result "foobar" is placed in a new top-level field called newfield.

... | eval newfield=replace("bar", /(bar)/, "foo$1");

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval body=replace(str: cast(body, "string"), rep: "<redacted>", pattern: /[0-9]{3}[-.][0-9]{3}[-.][0-9]{4}/);


rtrim(str, strip_chars)

This function takes two arguments. The required argument is str, a string. This function also takes an optional argument strip_chars, also a string. This function returns either str with whitespaces removed from the right side or str with the characters in strip_chars trimmed from the right side.

Function Input
str: string
(Optional) strip-chars: string
Function Output
string

1. SPL2 example

Returns " ZZZZabc".

... | eval n=rtrim(" ZZZZabcZZ", " Z");

2. SPL2 example

Returns " abc".

... | eval n= rtrim(" abc ");

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

... | eval n=rtrim(strip_chars: " Z", str: " ZZZZabcZZ");

spath(input, path)

For documentation on the spath function, see spath.

substr(str, start, length)

This function takes three arguments. The required arguments are str, a string, and start, an integer. This function also takes an optional argument length, also an integeer. This function returns a substring of str, starting at the index specified by start with the number of characters specified by length.

Function Input
str: string
start: integer
(Optional) length: integer
Function Output
string

SPL2 examples

Returns "foo".

...| eval n=substr("foobar", 1, 3);

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval n=substr(str: "foobar", length: 3, start: 1);

trim(str, strip_chars)

This function takes two arguments. The required argument is str, a string. This function also takes an optional argument strip_chars, also a string. This function returns either str with whitespaces removed from both sides or str with the characters in strip_chars trimmed from both sides.

Function Input
str: string
(Optional) strip_chars: string
Function Output
string

1. SPL2 example

Returns "abc".

...| eval n=trim(" ZZZZabcZZ ", " Z");

2. SPL2 example

Returns "abc".

...| eval n=trim(" abc ");

3. SPL2 example

Alternatively, you can use named arguments to list the arguments in any order. See SPL2 syntax for more details.

...| eval n=trim(strip_chars: "Z", str: " ZZZZabcZZ ");

upper(str)

Converts a string to uppercase.

Function Input
str: string
Function Output
string

SPL2 examples

Returns USERNAME.

...| eval n=upper(username);

Alternatively, you can use named arguments. See SPL2 syntax for more details.

...| eval n=upper(str: username);

url_decode(str)

Takes a URL string and returns the unescaped or decoded URL string.

Function Input
str: string
Function Output
string

SPL2 examples

Returns http://www.splunk.com/download?r=header.

url_decode("http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader");

Alternatively, you can use named arguments. See SPL2 syntax for more details.

...| eval n=url_decode(str: "http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader");

url_encode(str)

Encodes a string for the query string parameters in a URL. Use this function when you want to include user-supplied string data in a URL.

Function Input
str: string
Function Output
string

SPL2 examples

Filters records by Jane+A+Smith.

| where "Jane+A+Smith"=url_encode("Jane A Smith");

Alternatively, you can use named arguments. See SPL2 syntax for more details.

| where "Jane+A+Smith"=url_encode(str: "Jane A Smith");
Last modified on 31 October, 2020
PREVIOUS
Mathematical
  NEXT
Overview of stats scalar functions

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters