All Apps and Add-ons

Field extraction from another field

himynamesdave
Contributor
{"created_at":"Sat May 03 08:03:22 +0000 2014","id":462502661581852672,"id_str":"462502661581852672","text":"My fitbit #Fitstats_UK for 5\/02\/2014: 8,775 steps and 6.6 km traveled. http:\/\/t.co\/w1nD6GwtyB","source":"\u003ca href=\"http:\/\/www.fitbit.com\" rel=\"nofollow\"

Regex newbie checking in...

I would like to extract two different fields from this data:

8,775 steps = FitbitStepsRaw
8,775 = FitbitSteps

My usual go-to, the IFX, is failing me. Can anyone offer any advice?

Thanks!

p.s I am also using the Fitbit API to extract this data, but there is a valid use-case for this field extraction 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could use this expression:

:\s+(?<fitbitStepsRaw>(?<fitbitSteps>\d+(,\d+)*)\s+steps)
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...