All Apps and Add-ons

Field extraction from another field

himynamesdave
Contributor
{"created_at":"Sat May 03 08:03:22 +0000 2014","id":462502661581852672,"id_str":"462502661581852672","text":"My fitbit #Fitstats_UK for 5\/02\/2014: 8,775 steps and 6.6 km traveled. http:\/\/t.co\/w1nD6GwtyB","source":"\u003ca href=\"http:\/\/www.fitbit.com\" rel=\"nofollow\"

Regex newbie checking in...

I would like to extract two different fields from this data:

8,775 steps = FitbitStepsRaw
8,775 = FitbitSteps

My usual go-to, the IFX, is failing me. Can anyone offer any advice?

Thanks!

p.s I am also using the Fitbit API to extract this data, but there is a valid use-case for this field extraction 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could use this expression:

:\s+(?<fitbitStepsRaw>(?<fitbitSteps>\d+(,\d+)*)\s+steps)
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...