Splunk Dev

how to extract only one filed from events out of possible duplicates

VI371887
Path Finder

Hi I have event logs where

rex under field extraction, to extract each value following a string and stopping at first coma, and avoid duplicates

example :
hcyycuvubuv : 45544.466, "disk_byte" :23.45667, "disk_byte_quota": 23.345t,

in above string, I am only looking for numbers that come after "disk_byte" :
, which is 23.45667

problem is, in my events the disk_bytes string is not at the same location in logs and there's disk_bytes_quota which should be ignored.

example :

first event
chhchvhvh: 223. 455, "disk_byte" :23.45667,"disk_byte_quota": 23.345t,
gghffvhh:3455

second event
chhchvhvh: 223. 455, tuvjvujjvg:3456.566, "cpu_percentage":23.45677,gghffvhh:3455.788,"disk_byte" :23.45667, "disk_byte_quota": 23.345t,

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The regex string "disk_byte"\s:(?[\d.]+)" will extract the "disk_byte" field and ignore the "disk_bytes_quota" field.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The regex string "disk_byte"\s:(?[\d.]+)" will extract the "disk_byte" field and ignore the "disk_bytes_quota" field.

---
If this reply helps you, Karma would be appreciated.

VI371887
Path Finder

hi i am having similar issues,

with msg field

it's has different values can be numbers, strings, path, punctuations, blank space like shown below.

"msg" :"35556"
"msg" :"<<÷] {<} ;;"
"msg" :"ycuvuuu jvbigg buivuv"
"msg" :" "

now problem is, i have written rex as
\msg\":(? \". *\") \,

but it returns value which following msg field.

"msg" :"vjvuv igivc uvviv", "origin" :"abcgc", "time" :23.45677",

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...