topic Re: How to extract 3 characters after a given string in Splunk? in Splunk Search

How to extract 3 characters after a given string in Splunk?

avneet26 — Wed, 14 Dec 2022 07:40:49 GMT

I want to extract the two characters 78 from the barvalue and have it in a separate column in my table:-

deltavalue = 890(11%) sigmavalue=334(56%) barvalue=445(78%)

Re: How to extract 3 characters after a given string in Splunk?

yuanliu — Wed, 14 Dec 2022 07:57:24 GMT

Your title says 3 characters, yet the opening sentence says 2 characters. Which is it? Also, are you trying to extract all 2-character strings before the percent sign (%) or only the last one? Specifics are very important when you ask data questions.

Assuming that you only want the last percentage, you can do

| rex field=barvalue "\(?<barpercent>\d+)%\)"

Re: How to extract 3 characters after a given string in Splunk?

avneet26 — Wed, 14 Dec 2022 08:07:08 GMT

Ah my bad. sorry not three characters. only two numbers i want which is 78

Re: How to extract 3 characters after a given string in Splunk?

yuanliu — Wed, 14 Dec 2022 08:10:10 GMT

In that case, the code provided above should suffice. (You should have a field named barvalue. Correct?)

Re: How to extract 3 characters after a given string in Splunk?

avneet26 — Wed, 14 Dec 2022 08:34:18 GMT

barvalue is the search string in my _raw field.

Re: How to extract 3 characters after a given string in Splunk?

yuanliu — Wed, 14 Dec 2022 08:46:40 GMT

@avneet26 wrote:
barvalue is the search string in my _raw field.

Are you the admin? If not, you should ask them to make sure obvious key-value pairs are extracted; in fact, unless there is any special settings, Splunk extracts "a=b" in _raw as value "b" assigned to field "a". by default. With that, my first code should give you a new field barpercent.

But if your admin is uncooperative, you can do something like

| rex "barvalue=\d+\((?<barpercent>\d+)%\)"

Hope this helps.