topic Re: Extract Value in Splunk Search

Extract Value

nikhilmehra79 — Mon, 28 Sep 2020 16:10:16 GMT

I have a search result with following string i just need to extract the value - 0.000 (just before %) from this string below

"XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"

I tried following

..| rex field=_raw "(?.),(?.),(?.),(?.),(?.*)" | search Avail != null | table Avail but looks like i need to get more regex

Re: Extract Value

rsennett_splunk — Wed, 19 Mar 2014 01:07:58 GMT

Close... you're missing a few details.

Here is your regex (the double quotes are escaped only when you use them in the search box, because the rex command wants the regex contained in double quotes... it isn't regex that requires them escaped, mind you)

your base search | rex field=_raw"^\"(?P<name>.+)\",\"(?P<Type>.+)\",\"(?P<tdtime>.+)\",(?P<number_of_out>\d+),\"(?P<avail>.+)%\""

This site is very helpful for testing:

http://www.regexr.com/

Re: Extract Value

nikhilmehra79 — Wed, 19 Mar 2014 05:30:53 GMT

its says error

Error in 'rex' command: Invalid argument: '"(?<Type>.*)"'

Re: Extract Value

rsennett_splunk — Wed, 19 Mar 2014 06:22:34 GMT

You may want to just use the field extractor and avoid using the rex command altogether...

Re: Extract Value

nikhilmehra79 — Wed, 19 Mar 2014 06:45:29 GMT

you have a example and is it not possible to use regex to do the same?

Re: Extract Value

somesoni2 — Mon, 28 Sep 2020 16:10:47 GMT

above regex works for me

| head 1 | eval _raw="\"XYZ Inc\",\"Air\",\"0 Days + 01:00:00\",1,\"0.000 %\"" | table _raw | rex field=_raw "^\"(?P.+)\",\"(?P.+)\",\"(?P.+)\",(?P\d+),\"(?P.+)%\""

Re: Extract Value

rsennett_splunk — Wed, 19 Mar 2014 14:57:25 GMT

nikhilmehra79, you should copy EXACTLY what somesoni2 has given you and try that. Do not change the regex. It is the same as the one I gave you exactly... and it works. The difference is - this version has kindly given you the entire search. I was lazy. 🙂
I have edited the answer accordingly - including the prefix eval so that the code is independent for those of us who do not have your data in an index.

Re: Extract Value

nikhilmehra79 — Wed, 19 Mar 2014 16:08:53 GMT

Thanks

the point is "XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"
is just one example of event i have various other events with different text, in that case i dont think hard coding the values in seacrh will work?

Re: Extract Value

somesoni2 — Wed, 19 Mar 2014 17:31:29 GMT

remove the hard-coding part and use your own search parameter. This was just the example.

Re: Extract Value

nikhilmehra79 — Wed, 19 Mar 2014 22:31:51 GMT

Thanks worked.

Re: Extract Value

rsennett_splunk — Wed, 19 Mar 2014 22:45:14 GMT

Great! Glad we could help.