topic Re: Extracting fields and values in Splunk Search

Extracting fields and values

kavyatim — Tue, 29 Apr 2014 12:02:31 GMT

Hi , I have data in the below format:

[mpeg-1 audio, Service 1, PID 111] [Average rate 0.201 Mbits/s] [Min rate 0.199 Mbits/s] [Max rate 0.203 Mbits/s] [h.264 video, Service 1, PID 110] [Average rate 6.491 Mbits/s] [Min rate 6.474 Mbits/s] [Max rate 6.521 Mbits/s] [mpeg-1 audio, Service 1, PID 112] [Average rate 0.138 Mbits/s] [Min rate 0.135 Mbits/s] [Max rate 0.140 Mbits/s] [PMT, Service 2, PID 200] [Average rate 0.015 Mbits/s] [Min rate 0.015 Mbits/s] [Max rate 0.017 Mbits/s] [h.264 video, Service 2, PID 120] [Average rate 0.208 Mbits/s] [Min rate 0.193 Mbits/s] [Max rate 0.226 Mbits/s]

and I want to extract data as in the below format: Codec PID Average Rate Mbits/s Min Rate Mbits/s Max Rate Mbits/s mpeg-1 audio 111 0.201 0.199 0.203 [h.264 video 110 6.491 6.474 6.521 mpeg-1 audio 112 0.138 0.135 0.14 h.264 video 120 0.208 0.193 0.226

Can any one help me to extract using regex?

Thanking in advance

Re: Extracting fields and values

MuS — Tue, 29 Apr 2014 12:11:48 GMT

could you pleas reformat your result in better/nicer a way. Currently it is hard to determine what it should look like

Re: Extracting fields and values

lukejadamec — Tue, 29 Apr 2014 12:22:55 GMT

You want to extract these fields:

Codec
PID
Average Rate Mbits/s
Min Rate Mbits/s
Max Rate Mbits/s

With these values?

mpeg-1 audio
111
0.201
0.199
0.203

h.264 video
110
6.491
6.474
6.521

mpeg-1 audio
112
0.138
0.135
0.14

h.264 video
120
0.208
0.193
0.226

Have you tried the automated field extractor?

Re: Extracting fields and values

kavyatim — Tue, 29 Apr 2014 12:28:43 GMT

Hi Mus,

the results should be in tabular from with headers as below:

headers are : Codec,PID,Average Rate,Min Rate,Max Rate
and their respective values.

For example for Codec values will be mpeg-1 audio
[h.264 video,
mpeg-1 audio,
h.264 video.
and for PID values will be 111
110,
112,
120

Re: Extracting fields and values

richgalloway — Tue, 29 Apr 2014 13:14:55 GMT

This should get you started:

\[(<?Codec>[^,]*),[\s\S]*PID\s(?<PID>\d*)\]\s\[Average rate\s(?<AvgRate>[\d\.]*)[\s\S]*\]\s\[Min rate\s(?<MinRate>[\d\.]*)[\s\S]*\]\s\[Max rate\s(?<MaxRate>[\d\.]*)[\s\S]*\]