All Apps and Add-ons

Field extraction from another field

himynamesdave
Contributor
{"created_at":"Sat May 03 08:03:22 +0000 2014","id":462502661581852672,"id_str":"462502661581852672","text":"My fitbit #Fitstats_UK for 5\/02\/2014: 8,775 steps and 6.6 km traveled. http:\/\/t.co\/w1nD6GwtyB","source":"\u003ca href=\"http:\/\/www.fitbit.com\" rel=\"nofollow\"

Regex newbie checking in...

I would like to extract two different fields from this data:

8,775 steps = FitbitStepsRaw
8,775 = FitbitSteps

My usual go-to, the IFX, is failing me. Can anyone offer any advice?

Thanks!

p.s I am also using the Fitbit API to extract this data, but there is a valid use-case for this field extraction 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could use this expression:

:\s+(?<fitbitStepsRaw>(?<fitbitSteps>\d+(,\d+)*)\s+steps)
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...