Splunk Search

Help with regex in getting the value out of a certain word

mrccasi
Explorer

Hi everyone. Im not very good in doing regex. I would like to ask for you help here. The situation is to get a certain value based on the given word. The value does not have a format and very messy.

Below picture is the sample that I need. The regex needs to get the certain word and the next close and open parenthesis with percentage needed to be in the new field "(00%)" . Please see the picture below for the sample data.

Need to get the word Peach and the next (00%) to get will go to "Peach %". Same with other work like Banana//BANANA and Maple/MAPLE.

Thank you very much in advance if you are trying to help and answer my question.

Example:

alt text

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
try this:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,)"

that you can test at https://regex101.com/r/TsvivC/1

Ciao.
Giuseppe

0 Karma

mrccasi
Explorer

Hi gcusello,

Thank you but this is not what I'm after. I need to check each row if to see if there are Banana or Peach or Maple in it and get their percentage. Your regex is almost correct but you are not getting some of the fruits in the comments.

Like this one, Assignment details: Peach (40%), Maple (20%), and Banana (40%). You only get the Peach but it's returning the 40%. I need to have a look like this.

Peach Maple Banana
40% 20% 40%

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
In your data I don't see a rule to use for the regex.
If could be acceptable for you, it's possible to take the first word after "Assignment Details: " and the word before percentage with two regexes:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,).*\s+(?<fruit2>\w+)\s+\((?<perc2>\d+\%)"
| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)"

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...