Splunk Search

Extract an value from logged sentence

j3r0n
Explorer

Hi,
I'm trying to make a Splunk panel display a value from a log that gets added to every 4 minutes.
I need to be able to see on the dashboard if the value suddenly drops.
I've tried extracting the value, but it keeps messing up.
Should I use regex, or do I need to extract it in a different way?
My goal is to only get the value after "value= " to return.

This is how the data looks when it's imported into Splunk, each new line is a single event:

2020-05-14T13:39:28.423Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.003Z, machine= wefqwr2312, value= 14
2020-05-14T13:40:29.118Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.316Z, machine= wefqwr2312, value= 14
2020-05-14T13:41:28.323Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.032Z, machine= wefqwr2312, value= 14
2020-05-14T13:45:48.041Z, machine= wefqwr2312, value= 14

Thanks!

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this to your SPL and replace FIELD_NAME with your actual field name. I'd recommend fixing the logging to remove that space after value so Splunk can create the key value pair automatically without manually extracting

| rex value\=\s(?<FIELD_NAME>/d+)

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this to your SPL and replace FIELD_NAME with your actual field name. I'd recommend fixing the logging to remove that space after value so Splunk can create the key value pair automatically without manually extracting

| rex value\=\s(?<FIELD_NAME>/d+)

j3r0n
Explorer

Thanks alot for your reply!
I've edited the logging now, without the space after value.
Do I need a different rex now? And the extracted field of which I put the name in the regex, only has to be the "16" instead of "value=16" right?

skoelpin
SplunkTrust
SplunkTrust

Nothing further needed! Splunk will identify key value pairs automatically and extract them out for you. Splunk looks for common delimiters such as the : or = and identifies everything on the left side as the field and everything on the right side as the value. Keep it in the format of value=14

Once it has a little run time, go look at your fields on the left and find the field value to verify it extracts properly

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...