topic Re: How to extract a float value from 2 strings? in Splunk Search

How to extract a float value from 2 strings?

alangularte — Sun, 22 Apr 2018 03:47:57 GMT

How can I get all the float values that are between the strings "totalElapsedTime^" and "^" from the log sample bellow?

2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://schemas.dell.com/services/isp/assetheadersearch/03/1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null

Re: How to extract a float value from 2 strings?

niketn — Sun, 22 Apr 2018 05:37:04 GMT

@alangularte, please try out the following rex command:

 <yourBaseSearch>
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0

Following is a run anywhere search based on the the sample data provided:

| makeresults
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0
| table totalElapsedTime _raw

Re: How to extract a float value from 2 strings?

DalJeanis — Sun, 22 Apr 2018 05:46:17 GMT

Looks like you basically just need a rex.

| rex max_match=0 "\^(?<fieldname>\w+)\^(?<fieldvalue>[0-9.]+)(?=\^)"

This will extract every copy into two multivalue fields. I'm not clear whether your example is two different events, or if you needed the first or second set of data. If you need both, then you have an ambiguity issue due to repeating the same names.

The next step would be stitching each pair together and then using mvexpand to create single records, then assigning the fieldvalues to the fieldnames.

I'll hold off making code for that until you describe what you need to do with the data.

Re: How to extract a float value from 2 strings?

TISKAR — Sun, 22 Apr 2018 08:38:58 GMT

Hello @alangularte, Can you try this:

| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0

For example:

| makeresults 
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0