topic Re: How do you write rex to extract unstructured field? in Splunk Search

How do you write rex to extract unstructured field?

haja4nhn — Tue, 17 Oct 2017 17:25:35 GMT

I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field.

10/1/2017       0:10:01            all        9.13     0          1.68     6.6       0          82.59
10/1/2017       0:20:01            all        7.46     0          0          5.74     0          85.17
10/1/2017       0:30:01            all        9.05     0          129     1.53     0          88.13
10/1/2017       0:40:01            all        7.77     0          1.45     1.23     0          89.54
10/1/2017       0:50:01            all        7.08     0          1.5       1.41     0          90.02
10/1/2017       1:00:01            all        6.46     0          1.43     1.82     0          90.29
10/1/2017       1:10:01            all        45.4     0          4.2       29.27   0          21.13
10/1/2017       1:20:01            all        61.74   0          4.74     31.19   0          2.32
10/1/2017       1:30:01            all        64.17   0          4.72     26.31   0          4.81
10/1/2017       1:40:01            all        47.54   0          4.23     19.44   0          28.79
10/1/2017       1:50:01            all        44.59   0          3.68     17.47   0          34.27
10/1/2017       2:00:01            all        49.16   0          4.22     13.47   0          33.15
10/1/2017       2:10:01            all        41.98   0          3.95     16.47   0          37.59

Thanks.

Re: How do you write rex to extract unstructured field?

sbbadri — Tue, 17 Oct 2017 18:07:27 GMT

@haja4nhn

try this,

you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)"

Re: How do you write rex to extract unstructured field?

cpetterborg — Tue, 17 Oct 2017 18:53:13 GMT

This is probably the most efficient way to do the field extraction:

^(\S+\s+){5}(?P<field6>\S+)

It requires few steps and has the advantage of being able to extract any data, including strings. It does require that the spaces only be between columns of the data (so no fields that have spaces in them). It's also pretty easy to read and modify.

Re: How do you write rex to extract unstructured field?

s2_splunk — Tue, 29 Sep 2020 16:16:27 GMT

If you have the option, define your sourcetype for this log source in props.conf and use the FIELD_NAMES / FIELD_DELIMITER to assign the proper field names. Keeps your searches clean... 😉

Re: How do you write rex to extract unstructured field?

lfedak_splunk — Tue, 17 Oct 2017 21:58:47 GMT

Hey @haja4nhn, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

Re: How do you write rex to extract unstructured field?

haja4nhn — Fri, 20 Oct 2017 13:37:24 GMT

@cpetterborg

Thanks for your reply.

Let me check this..

Re: How do you write rex to extract unstructured field?

haja4nhn — Fri, 20 Oct 2017 13:38:42 GMT

@sbbadri

I have tried this looks like the values are changing. I checking and trying to alter your rex.

Lets see.

Thanks for your help.

Re: How do you write rex to extract unstructured field?

landen99 — Fri, 20 Oct 2017 15:58:41 GMT

Anchor on the word "all",
props.conf

[myst]
EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+)

195 steps. https://regex101.com/r/l2PGs6/2

Change myst to your sourcetype and field1 to your field name.