Extract field with regex issue

[j3r0n]

I'm trying to only extract the value of 'value' with regex.

2020-03-04 12:14:26,363 - measurement:34- sensor=43, value="0.034051", date="None"

I've tried this but it didn't work:

| rex field=value "(?<myValue>\d{3})" | search myValue=*

Where did it go wrong and how do I solve this?

[richgalloway · Accepted solution]

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.

[vnravikumar]

Hi

Check this rex

value="(?P<value>[^"]+)