Dashboards & Visualizations

extract field values

msarkaus
Path Finder

Hello, I’m trying to only pull a spefic value from the msgTxt log. In the log below, the example is 2024. This value does change and could be one digit or up to 6 digits.

msgTxt = xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory | property type: Commercial | address: x RxxxDANx DR , xxxSHFIELD , xx 02xx0)

Below is the search I'm trying to use but its not working. Any help would be apreseated.

| eval msgTxt=" msgTxt: xxiskServicxxxapper - MxxeNext completed in 2024 ms. (request details: environment: Production | desired services: BusixxxsOwnexxxerritory*"
| rex "in=(?<in>\w+)."
| stats count by in

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're very close.  Use \d (digit) in place of \w (word).  Also, remove the '=' since there is no such character in the data.

| rex "in (?<in>\d+)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're very close.  Use \d (digit) in place of \w (word).  Also, remove the '=' since there is no such character in the data.

| rex "in (?<in>\d+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

msarkaus
Path Finder

Sorry to be a bother, but what if there is a special char like = involved. I can't add the equal sign into my search query.

 

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*"
| rex "Duration (<?Duration>\d+)"
| timechart span=1h avg(Duration) AS avg_response by msxxxt

 

Thanks again for your help

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The search command cannot search for '*'.  The '=' character also is a challenge.  You can, however, use regex to filter on these and other "special" characters.

| eval msxxxt="*Action=GexxxxdledxxxxReport Duration=853*"
| regex "="
| rex "Duration (<?Duration>\d+)"
| timechart span=1h avg(Duration) AS avg_response by msxxxt
---
If this reply helps you, Karma would be appreciated.
0 Karma

msarkaus
Path Finder

Thank you

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...