topic Re: How do I extract a field from the _raw data in Splunk Dev

How do I extract a field from the _raw data

danielsan — Tue, 29 Sep 2020 19:47:34 GMT

Hi guys,

Tried my best googling an answer but have not been able to find something that fits my requirement.

I have the following raw_data:

... \"number_of_goods\":10,\"number_of_locations\":5, ...

How do I create a field called number_of_goods and number_of_locations where the value is 10 and 5?

Many thanks in advance!

Re: How do I extract a field from the _raw data

richgalloway — Thu, 31 May 2018 12:48:43 GMT

Try the rex command. The backslashes are needed to escape the backslashes and quotes in your data.

<your search> | rex "number_of_goods\\\\\":(?<numberOfGoods>\d+),\\\\\"number_of_locations\\\\\":(?<numberOfLocations>\d+)" | ...

Re: How do I extract a field from the _raw data

FrankVl — Thu, 31 May 2018 13:23:13 GMT

I guess you could also avoid having to mess with those backslashes and escaped quotes, by doing:

| rex "number_of_goods[^:]+:(?<numberOfGoods>\d+),[^\w]+number_of_locations[^:]+:(?<numberOfLocations>\d+)"

https://regex101.com/r/RgxoTh/1

Re: How do I extract a field from the _raw data

danielsan — Thu, 31 May 2018 13:29:35 GMT

It works, you really saved my day. I have one follow-up question though. I'm trying to extract a similar field but it has a decimal value, e.g. 0.25 and with the rex example I got from you, I only get the first digit before the decimal and I can't figure out how to get the full value.

Re: How do I extract a field from the _raw data

richgalloway — Thu, 31 May 2018 15:46:09 GMT

The regex for a floating point number is \d+\.\d+.

Re: How do I extract a field from the _raw data

richgalloway — Thu, 31 May 2018 15:48:56 GMT

If your problem is resolved, please accept the answer to help future readers.