topic Extract and/or add numbers from a string in Splunk Search

Extract and/or add numbers from a string

apoorvaaccount — Wed, 28 Feb 2024 17:19:19 GMT

I have string field:

provTimes: a=10; b=15; c=10;

it basically has semicolon separated sub-fields in the value. Each sub-field has a number on right hand side.

These fields are dynamic, can be a,v,e,f in 1 event and z,y in another event. Ignoring the sub field names, I'm only concerned with the numbers they have. I just want to add them all.

Example

provTimes: a=10; b=15; c=10;

result = 35

provTimes: x=10; b=5;

result = 15

Re: Extract and/or add numbers from a string

richgalloway — Wed, 28 Feb 2024 18:07:01 GMT

If you can install the mvstats app (https://splunkbase.splunk.com/app/5198) then this will do it.

| rex max_match=0 "provTimes: \w+=(?<provTimes>\d+);" | mvstats sum provTimes as result

Re: Extract and/or add numbers from a string

yuanliu — Wed, 28 Feb 2024 22:56:26 GMT

Or, in the old fashioned extract (aka kv) and foreach😉,

Here is an emulation you can play with and compare with real data

| makeresults format=csv data="provTimes a=10; b=15; c=10; x=10; b=5;" ``` data emulation above ```

Output from this emulation is

provTimes	sum
a=10; b=15; c=10;	35
x=10; b=5;	15