Extract Value

[nikhilmehra79]

I have a search result with following string i just need to extract the value - 0.000 (just before %) from this string below

"XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"

I tried following

..| rex field=_raw "(?.),(?.),(?.),(?.),(?.*)" | search Avail != null | table Avail but looks like i need to get more regex

[rsennett_splunk · Accepted solution]

Close... you're missing a few details.

Here is your regex (the double quotes are escaped only when you use them in the search box, because the rex command wants the regex contained in double quotes... it isn't regex that requires them escaped, mind you)

your base search | rex field=_raw"^\"(?P<name>.+)\",\"(?P<Type>.+)\",\"(?P<tdtime>.+)\",(?P<number_of_out>\d+),\"(?P<avail>.+)%\""

This site is very helpful for testing:

http://www.regexr.com/

[rsennett_splunk]

Great! Glad we could help.

[nikhilmehra79]

Thanks worked.

[somesoni2]

remove the hard-coding part and use your own search parameter. This was just the example.

[nikhilmehra79]

Thanks

the point is "XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"
is just one example of event i have various other events with different text, in that case i dont think hard coding the values in seacrh will work?

[rsennett_splunk]

nikhilmehra79, you should copy EXACTLY what somesoni2 has given you and try that. Do not change the regex. It is the same as the one I gave you exactly... and it works. The difference is - this version has kindly given you the entire search. I was lazy. 🙂
I have edited the answer accordingly - including the prefix eval so that the code is independent for those of us who do not have your data in an index.

[somesoni2]

above regex works for me

• | head 1 | eval _raw="\"XYZ Inc\",\"Air\",\"0 Days + 01:00:00\",1,\"0.000 %\"" | table _raw | rex field=_raw "^\"(?P.+)\",\"(?P.+)\",\"(?P.+)\",(?P\d+),\"(?P.+)%\""

[nikhilmehra79]

you have a example and is it not possible to use regex to do the same?

[rsennett_splunk]

You may want to just use the field extractor and avoid using the rex command altogether...

[nikhilmehra79]

its says error

Error in 'rex' command: Invalid argument: '"(?<Type>.*)"'