topic Re: Extract an value from logged sentence in Splunk Search

Extract an value from logged sentence

j3r0n — Thu, 14 May 2020 13:56:19 GMT

Hi,
I'm trying to make a Splunk panel display a value from a log that gets added to every 4 minutes.
I need to be able to see on the dashboard if the value suddenly drops.
I've tried extracting the value, but it keeps messing up.
Should I use regex, or do I need to extract it in a different way?
My goal is to only get the value after "value= " to return.

This is how the data looks when it's imported into Splunk, each new line is a single event:

2020-05-14T13:39:28.423Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.003Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.118Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.316Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.323Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.032Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.041Z, machine= wefqwr2312, value= 14

Thanks!

Re: Extract an value from logged sentence

skoelpin — Thu, 14 May 2020 14:07:42 GMT

Add this to your SPL and replace FIELD_NAME with your actual field name. I'd recommend fixing the logging to remove that space after value so Splunk can create the key value pair automatically without manually extracting

| rex value\=\s(?<FIELD_NAME>/d+)

Re: Extract an value from logged sentence

j3r0n — Thu, 14 May 2020 14:28:08 GMT

Thanks alot for your reply!
I've edited the logging now, without the space after value.
Do I need a different rex now? And the extracted field of which I put the name in the regex, only has to be the "16" instead of "value=16" right?

Re: Extract an value from logged sentence

skoelpin — Thu, 14 May 2020 14:30:11 GMT

Nothing further needed! Splunk will identify key value pairs automatically and extract them out for you. Splunk looks for common delimiters such as the : or = and identifies everything on the left side as the field and everything on the right side as the value. Keep it in the format of value=14

Once it has a little run time, go look at your fields on the left and find the field value to verify it extracts properly