Splunk Search
Highlighted

Extract Value

Path Finder

I have a search result with following string i just need to extract the value - 0.000 (just before %) from this string below

"XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"

I tried following

..| rex field=raw "(?.),(?.),(?.*),(?<NumberOf_Out>.),(?.)" | search Avail != null | table Avail but looks like i need to get more regex

Tags (3)
0 Karma
Highlighted

Re: Extract Value

Splunk Employee
Splunk Employee

Close... you're missing a few details.

Here is your regex (the double quotes are escaped only when you use them in the search box, because the rex command wants the regex contained in double quotes... it isn't regex that requires them escaped, mind you)

your base search | rex field=_raw"^\"(?P<name>.+)\",\"(?P<Type>.+)\",\"(?P<tdtime>.+)\",(?P<number_of_out>\d+),\"(?P<avail>.+)%\""

This site is very helpful for testing:

http://www.regexr.com/

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Highlighted

Re: Extract Value

Path Finder

its says error

Error in 'rex' command: Invalid argument: '"(?<Type>.*)"'
0 Karma
Highlighted

Re: Extract Value

Splunk Employee
Splunk Employee

You may want to just use the field extractor and avoid using the rex command altogether...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Highlighted

Re: Extract Value

Path Finder

you have a example and is it not possible to use regex to do the same?

0 Karma
Highlighted

Re: Extract Value

SplunkTrust
SplunkTrust

above regex works for me

  • | head 1 | eval raw="\"XYZ Inc\",\"Air\",\"0 Days + 01:00:00\",1,\"0.000 %\"" | table _raw | rex field=raw "^\"(?P.+)\",\"(?P.+)\",\"(?P.+)\",(?P\d+),\"(?P.+)%\""
Highlighted

Re: Extract Value

Splunk Employee
Splunk Employee

nikhilmehra79, you should copy EXACTLY what somesoni2 has given you and try that. Do not change the regex. It is the same as the one I gave you exactly... and it works. The difference is - this version has kindly given you the entire search. I was lazy. 🙂
I have edited the answer accordingly - including the prefix eval so that the code is independent for those of us who do not have your data in an index.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Highlighted

Re: Extract Value

Path Finder

Thanks

the point is "XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"
is just one example of event i have various other events with different text, in that case i dont think hard coding the values in seacrh will work?

0 Karma
Highlighted

Re: Extract Value

SplunkTrust
SplunkTrust

remove the hard-coding part and use your own search parameter. This was just the example.

0 Karma
Highlighted

Re: Extract Value

Path Finder

Thanks worked.

0 Karma