topic Extract field with regex issue in Splunk Search

Extract field with regex issue

j3r0n — Wed, 06 May 2020 13:22:26 GMT

I'm trying to only extract the value of 'value' with regex.

2020-03-04 12:14:26,363 - measurement:34- sensor=43, value="0.034051", date="None"

I've tried this but it didn't work:

| rex field=value "(?<myValue>\d{3})" | search myValue=*

Where did it go wrong and how do I solve this?

Re: Extract field with regex issue

vnravikumar — Wed, 06 May 2020 13:31:21 GMT

Check this rex

value="(?P<value>[^"]+)

Re: Extract field with regex issue

richgalloway — Wed, 06 May 2020 13:33:00 GMT

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.