topic Re: how to filter an word from a string using SPL in Splunk Search

How to filter an word from a string using SPL?

ABHAYA — Tue, 21 Mar 2023 16:58:37 GMT

e.g. input : CustomerService API call compeled in 105 ms Expected output : Customerservice 105 (in some graphical reprentation)

Re: how to filter an word from a string using SPL

ITWhisperer — Tue, 21 Mar 2023 12:21:56 GMT

| rex "(?<API>\w+) API call completed in (?<completion_time>\d+) ms"

Re: how to filter an word from a string using SPL

ABHAYA — Tue, 21 Mar 2023 13:08:49 GMT

It is returning only the 1st digit of the number not the whole number. for e.g. returning 1 for 105.is there any way to improve above query.

Re: how to filter an word from a string using SPL

ITWhisperer — Tue, 21 Mar 2023 13:15:26 GMT

Did you include the '+' after the '\d'?

Re: how to filter an word from a string using SPL

ABHAYA — Thu, 23 Mar 2023 10:10:15 GMT

@ITWhisperer Thanks. The solution provided by you worked for me. but if the host name contains ip which contains number e.g.it2 or uat2 so it returns first number which is wrong. is it better way to find a number which is present in before specific word like ms.

e.g. Input : customerservice it2-customer.com completed in 56 ms.

Expected output customerservice 56.

Current output customerservice 2.

Re: how to filter an word from a string using SPL

ITWhisperer — Thu, 23 Mar 2023 11:17:25 GMT

| makeresults | eval _raw="customerservice it2-customer.com completed in 56 ms." | rex "(?<API>\S+) completed in (?<completion_time>\d+) ms"

Re: How to filter an word from a string using SPL?

ABHAYA — Fri, 24 Mar 2023 10:31:37 GMT

@ITWhisperer Thanks. The solution provided by you worked for me.How can we find the average time for each service call.

e.g. Input : customerservice it2-customer.com completed in 10 ms.

customerservice it2-customer.com completed in 8 ms

Expected output: customerservice 9.

Re: How to filter an word from a string using SPL?

ITWhisperer — Fri, 24 Mar 2023 10:47:36 GMT

| stats avg(completion_time) as avg_completion_time by API

Re: How to filter an word from a string using SPL?

ABHAYA — Tue, 28 Mar 2023 12:02:17 GMT

@ITWhisperer How can we remove specific service from the result of splunk query. Our splunk query gives below result but we dont want ExampleService in our response . How can we remove using SPL.

We tried Servicename !=ExampleService. it is not working .Please suggest what need to be done here?

e.g. Input : customerservice 56 ms.

ExampleService 12 ms

Expected output customerservice 56.

Re: How to filter an word from a string using SPL?

ITWhisperer — Tue, 28 Mar 2023 12:05:09 GMT

Exactly what did you try - please share your SPL search

Re: How to filter an word from a string using SPL?

ABHAYA — Wed, 29 Mar 2023 10:06:04 GMT

@ITWhisperer I got expected result by ServiceName != <value_to_be_added> in the last of SPL query. Thank you for your response.