Splunk Search

Extracting fields and values

kavyatim
Path Finder

Hi , I have data in the below format:

[mpeg-1 audio, Service 1, PID 111] [Average rate 0.201 Mbits/s] [Min rate 0.199 Mbits/s] [Max rate 0.203 Mbits/s] [h.264 video, Service 1, PID 110] [Average rate 6.491 Mbits/s] [Min rate 6.474 Mbits/s] [Max rate 6.521 Mbits/s] [mpeg-1 audio, Service 1, PID 112] [Average rate 0.138 Mbits/s] [Min rate 0.135 Mbits/s] [Max rate 0.140 Mbits/s] [PMT, Service 2, PID 200] [Average rate 0.015 Mbits/s] [Min rate 0.015 Mbits/s] [Max rate 0.017 Mbits/s] [h.264 video, Service 2, PID 120] [Average rate 0.208 Mbits/s] [Min rate 0.193 Mbits/s] [Max rate 0.226 Mbits/s]

and I want to extract data as in the below format: Codec PID Average Rate Mbits/s Min Rate Mbits/s Max Rate Mbits/s mpeg-1 audio 111 0.201 0.199 0.203 [h.264 video 110 6.491 6.474 6.521 mpeg-1 audio 112 0.138 0.135 0.14 h.264 video 120 0.208 0.193 0.226

Can any one help me to extract using regex?

Thanking in advance

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started:

\[(<?Codec>[^,]*),[\s\S]*PID\s(?<PID>\d*)\]\s\[Average rate\s(?<AvgRate>[\d\.]*)[\s\S]*\]\s\[Min rate\s(?<MinRate>[\d\.]*)[\s\S]*\]\s\[Max rate\s(?<MaxRate>[\d\.]*)[\s\S]*\]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should get you started:

\[(<?Codec>[^,]*),[\s\S]*PID\s(?<PID>\d*)\]\s\[Average rate\s(?<AvgRate>[\d\.]*)[\s\S]*\]\s\[Min rate\s(?<MinRate>[\d\.]*)[\s\S]*\]\s\[Max rate\s(?<MaxRate>[\d\.]*)[\s\S]*\]
---
If this reply helps you, Karma would be appreciated.

kavyatim
Path Finder

Hi Mus,

the results should be in tabular from with headers as below:

headers are : Codec,PID,Average Rate,Min Rate,Max Rate
and their respective values.

For example for Codec values will be mpeg-1 audio
[h.264 video,
mpeg-1 audio,
h.264 video.
and for PID values will be 111
110,
112,
120

0 Karma

lukejadamec
Super Champion

You want to extract these fields:

Codec
PID
Average Rate Mbits/s
Min Rate Mbits/s
Max Rate Mbits/s

With these values?

mpeg-1 audio
111
0.201
0.199
0.203

h.264 video
110
6.491
6.474
6.521

mpeg-1 audio
112
0.138
0.135
0.14

h.264 video
120
0.208
0.193
0.226

Have you tried the automated field extractor?

0 Karma

MuS
Legend

could you pleas reformat your result in better/nicer a way. Currently it is hard to determine what it should look like

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...