topic Re: How to edit my regular expression to extract numbers before key characters in my sample data? in Splunk Search

How to edit my regular expression to extract numbers before key characters in my sample data?

JoshuaJohn — Wed, 07 Sep 2016 19:54:01 GMT

I have this statement:

10.211.1.114    10.222.3.33:4331    -   2016-09-07  14:10:06    0.004   GET /openapi-rest-web/akamai-object.htm -   200 6548    "Java/1.7.0_45" "54.444.444.444"    -   null    [corRID::null]  [KEY::-HTTPMonitor-Loyalty] [UID::-]

I am trying to grab the 0.004

10.200.1.200    10.002.0.98:012 -   2016-09-07  14:40:06    0.39    POST    /openapi-rest-web/v1/kohlsCash  -   200 918 "Apache-HttpClient/4.3.3 (java 1.5)"    "100.100.00.187, 144.41.141.00, 144.41.141.44, 54.009.200.002, 144.41.141.44"   -   null    [corRID::NAID-iOS-98797AB9-2978-4987-90CA-059879789-1473276124.978987]  [KEY::NUNlVg4532432523mLL8MEpqVvxW9]    [UID::-]

I am trying to grab the 0.39

I have this regular expression so far: ^.*(GET|POST)
Which gets me everything before the GET or POST

Any suggestions?

Re: How to edit my regular expression to extract numbers before key characters in my sample data?

sundareshr — Wed, 07 Sep 2016 20:04:23 GMT

Try this

... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers

Re: How to edit my regular expression to extract numbers before key characters in my sample data?

JoshuaJohn — Wed, 07 Sep 2016 20:22:34 GMT

Doesn't seem to work sorry, only getting blank null entries using that

Re: How to edit my regular expression to extract numbers before key characters in my sample data?

somesoni2 — Wed, 07 Sep 2016 20:25:35 GMT

This should do it

your base search | rex "^(\S+\s+){5}(?<YourFieldName>\S+)"

Re: How to edit my regular expression to extract numbers before key characters in my sample data?

JoshuaJohn — Wed, 07 Sep 2016 20:26:03 GMT

| rex "(?\d+\.\d+)\s(GET|POST)" | where match(response_time,"[a-zA-Z0-9]")| table response_time

This did it