Getting Data In

Parsing text

mfrederickson
New Member

I apologize in advance if this question has already been asked and answered. If it has, I am most likely demonstrating my lack of experience in not knowing what to properly search for. I am relatively new to regex. Here is my problem:

I have several records in my file that contain a three digit number (233, 252, 245, etc.) In the lines I am concerned about, they always appear between the ampersand:

& 232 &

& 252 &

So it's ampersand, space, three digit number, space and then ampersand.

How can I extract just the number from the string? I can't seem to find what I am looking for - I really do better with actual examples.....

Any assistance would be appreciated.....even if it's pointing me to documentation somewhere (I know RTFM...)

Thanks

Tags (1)
0 Karma

mfrederickson
New Member

Thanks Vince - I'll give that a shot. I knew it couldn't be that complicated - just having a major brain fart...

0 Karma

vincesesto
Communicator

Hey mfrederckson,

This should be pretty straight forward with a regex such as the following:
&\s(?P[^ ]+)\s&

If you could provide some more information on the actual logs you are searching through, as well as the context of your regex, eg; is it for a props.conf or a search, etc...I would be happy to assist further.

Regards Vince

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...