topic Re: Regex help in Splunk Search

Regex help

agoktas — Thu, 17 Dec 2015 21:38:17 GMT

Hello,

Would anyone know the regex value for the final numeric value after the last comma in the following log entry:

BlahBlah 2015/12/17 13:23:48:266,63

So all I need is the number after the last comma. It can be 1 or more digits (including zero).

I'm creating a named variable, but this doesn't work:

| rex ", (?P<TrasactionTime>\d+)$" | top 10 TrasactionTime

Thanks!

Re: Regex help

sundareshr — Thu, 17 Dec 2015 21:46:27 GMT

Try this

... | rex (?<TransactionTime>\d+)$ | top 10 TransactionTime

Re: Regex help

MuS — Thu, 17 Dec 2015 21:49:21 GMT

Hi agoktas,

almost correct, your regex has a whitespace too much so this will work:

your search here | rex ",(?<TrasactionTime>\d+)$" | top 10 TrasactionTime

Hope this helps ...

cheers, MuS

Re: Regex help

agoktas — Thu, 17 Dec 2015 23:06:10 GMT

Bingo! That's it. 🙂 I knew it was close. 😉

By the way, how do you sort by the values it returns? I noticed if I do a:
| top 10 TrasactionTime
It will only return the 10 most frequent occurred values, versus the top 10 values.

Re: Regex help

MuS — Thu, 17 Dec 2015 23:11:02 GMT

after the rex instead of top use sort TrasactionTime for ascending or sort - TrasactionTime for descending sort and add also | head 10 at the end to get only the the last 10 result after the sort.

Re: Regex help

agoktas — Thu, 17 Dec 2015 23:34:11 GMT

Perfect.

One last thing... sorry...
How do you only allow the "TrasactionTime" column to show?

It now displays the TrasactionTime & Rawlog columns. The raw log clutters the panel.

Thanks.

Re: Regex help

MuS — Fri, 18 Dec 2015 00:37:08 GMT

either use:

  | fields TrasactionTime

  | table TrasactionTime

BTW should this be TransactionTime instead of TrasactionTime?

Feel free to up vote the additional answers - thanks :))

Re: Regex help

agoktas — Fri, 18 Dec 2015 00:42:24 GMT

Table TransactionTime worked perfectly.

fields TransactionTime still had other columns.

Yes, I made a typo. "Transaction" is correct. 😉

Thanks again for all your help!