topic Re: How to edit my regular expression to extract the numbers and semicolons from my sample data? in Splunk Search

How to edit my regular expression to extract the numbers and semicolons from my sample data?

ayusuf — Tue, 25 Oct 2016 16:39:35 GMT

I don't understand how Splunk does regex!
I have this search below:

...
| spath output=test path=a.b.c
| rex field=test "?<test1>[0-9]+"
| table test, test1

Test is this: {"timehours":"16","timeminutes":"34","timeseconds":"11"}

How do I extract just the numbers and semicolon except the first semicolon?
Thanks!

Re: How to edit my regular expression to extract the numbers and semicolons from my sample data?

sundareshr — Tue, 25 Oct 2016 17:29:45 GMT

Try this

 ...
 | spath output=test path=a.b.c
 | rex max_match=3 field=test "(?<t>\d{1,2})"
 | eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
 | table test, test1

Re: How to edit my regular expression to extract the numbers and semicolons from my sample data?

ayusuf — Wed, 26 Oct 2016 13:17:27 GMT

That works but is there a way to do it all in rex? Thanks.

Re: How to edit my regular expression to extract the numbers and semicolons from my sample data?

sundareshr — Wed, 26 Oct 2016 13:35:17 GMT

With rex mode=sed you cannot assign the result to a different field. Try this

  ... | rex mode=sed field=test "s/{\"timehours\":\"(\d+).+?:\"(\d+).+?:\"(\d+)\"}/\1:\2:\3/g" | table test

Re: How to edit my regular expression to extract the numbers and semicolons from my sample data?

DalJeanis — Wed, 01 Feb 2017 19:32:35 GMT

Here's another way. Still couldn't get it in just one rex.

This generates test results -

| makeresults | eval testfield="{\"timehours\":\"16\",\"timeminutes\":\"34\",\"timeseconds\":\"11\"}"

This pulls out the time parts -

| rex field=testfield max_match=3 "(?<mytime>\d{1,2})" | eval mytime=mvjoin(mytime,":")