topic Re: Extracting values from a field in Splunk Search

Extracting values from a field

ibekacyril — Tue, 22 Mar 2016 22:39:15 GMT

I have 2 fields like these:

For Field 1:
type=Intelligence

Field 2:
[abcd=[type=High] [Number=3309934] ]

I know I can search by type but there is another field named also named type so if I do

| ...stats count by type

I would get:

Intelligence

How do I specifically extract High from Field 2 (Typing High in the search is not an option because you could have type=Small

Also, using this code:

| ...stats count by abcd

produces : type=High

I only want to see High and not "type="
If you can provide a workable solution either using rex and eval or another code, it would be appreciated.

Thanks in advance

Re: Extracting values from a field

lguinn2 — Wed, 23 Mar 2016 00:25:06 GMT

Try this:

yoursearchhere
| rex field=abcd "=\[type=(?<new_type>.*?)\]"
| stats count by new_type
| rename new_type as type

This should give you a field named "new_type." It is best if you pick a different field name, otherwise Splunk will merge all the field definitions. I renamed it at the end. This also assumes that what you want is part of the existing field "abcd".

Re: Extracting values from a field

lguinn2 — Wed, 23 Mar 2016 16:09:51 GMT

If the above doesn't work, try this:

 yoursearchhere
 | rex  "=\[type=(?<new_type>.*?)\]"
 | stats count by new_type
 | rename new_type as type

or this

 yoursearchhere
 | rex  "\=\[type\=(?<new_type>.*?)\]"
 | stats count by new_type
 | rename new_type as type

I did make typo in the original answer, which I have now fixed. It is stats not stat! I still don't see anything wrong witn the original regular expression, but maybe someone else will...

Re: Extracting values from a field

ibekacyril — Thu, 24 Mar 2016 01:26:29 GMT

Thanks for your help

Re: Extracting values from a field

chimell — Thu, 24 Mar 2016 13:13:05 GMT

Hi
try this search code

............................. | rex  field=_raw  "/[abcd/=/[type/=(?<Type>[^\/]]+)" | stats count by Type

Re: Extracting values from a field

ibekacyril — Fri, 01 Apr 2016 19:21:40 GMT

Thanks for your help