Humio Query split strings

145 Views Asked by At

I'm using the following code to split parts of the rawstring into their own fields.

| description := splitString(field=@rawstring, by="[,]", index=1)
| Queue := splitString(field=@rawstring, by="[,]", index=2)
| Roundtrip := splitString(field=@rawstring, by="[,]", index=3)

The issue I'm having is that the rawstring line isn't always the same. There are three different scenarios for it. Here are three examples of the scenarios:

  1. {"home":0,"description":"a=1 b=(Block) t=52 A=2041 adbh=1111 (3539), Event: responseJson seq:[1]","queue_time":0,"roundtrip_time":28,"number":11111111111,"id":600}

  2. {"home":0,"description":"a=1 b=(Block) t=52 A=2041 adbh=1111 (3539), Talkback: 1 seq:[1]","queue_time":0,"roundtrip_time":28,"number":11111111111,"id":600}

  3. {"home":1,"description":"","queue_time":0,"roundtrip_time":46,"number":11111111111,"id":600}

Scenarios 1 and 2 have extra commas, causing "Event" and "Talkback" to be mistakenly placed in the "Queue" field. Is there a way, when these scenarios occur, to keep "Event" and "Talkback" in their intended position under "description"? I've been struggling to figure this out and would appreciate any guidance you can offer.

0

There are 0 best solutions below