How to extract values from within a field?

nitz13 — Tue, 17 Apr 2018 15:02:54 GMT

I have events of the following format:

 {  [-]      
         log:    2018-04-16 11:33:09 INFO  Report:46 - Number of Records read from Input File [10000] , number of records Posted [10000] to topic [completed.processing]
     stream:     stdout 

 time:   2018-04-16T16:33:09.36532399Z  

} }

Log is an extracted field and I want to extract the values "Number of records read from Input file and number of records posted" from within the field log and display it as a table of the following format:
Number of Input Records . Number of records posted
10000 10000

Re: How to extract values from within a field?

kmaron — Tue, 17 Apr 2018 16:52:01 GMT

You should be able to use a regular expression to pull out the number of input records and number of records posted. Then make a table from them.

| makeresults 
| eval log="2018-04-16 11:33:09 INFO  Report:46 - Number of Records read from Input File [10000] , number of records Posted [10000] to topic " 
| rex field=log "Number of Records read from Input File \[(?<InputRecords>.*?)\] , number of records Posted \[(?<PostedRecords>.*?)\] to topic" 
| rename InputRecords as "Number of Input Records" PostedRecords as "Number of Records Posted" 
| table "Number of Input Records" "Number of Records Posted"

topic Re: How to extract values from within a field? in Splunk Search

How to extract values from within a field?

Re: How to extract values from within a field?