Splunk Enterprise

Splunk regex in fields

leandrodematosp
New Member

I have the field below and I need the value not to have a comma, because I need to add up. How can I change the "," by a "." The fields are Valor and Frete.

Ex: Valor = "164,00"

After: Valor = 164.00

IP="189.80.213.213",Produto="Chuveiro Ducha Advanced Eletronica Turbo Lorenzetti",Valor="164,00",Categoria=Banho,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="4",Frete="17,26",Time=2021/01/26 19:06:32.179"

IP="187.72.163.215",Produto="Home Sleep Painel Para Tv 32 E 42 Acapulco E Panama Simbal",Valor="159,90",Categoria=Sala,Campanha="2",Vendeu="1",MetododeCompra="1",Bandeira="1",Transportadora="3",Frete="16,31",Time=2021/01/26 19:06:31.779"

.

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use either replace or rex like this

| eval Frete=replace(Frete, ",", ".")
| rex field=Valor mode=sed "s/,/./"

 

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...