Splunk Search

Help with regex in getting the value out of a certain word

mrccasi
Explorer

Hi everyone. Im not very good in doing regex. I would like to ask for you help here. The situation is to get a certain value based on the given word. The value does not have a format and very messy.

Below picture is the sample that I need. The regex needs to get the certain word and the next close and open parenthesis with percentage needed to be in the new field "(00%)" . Please see the picture below for the sample data.

Need to get the word Peach and the next (00%) to get will go to "Peach %". Same with other work like Banana//BANANA and Maple/MAPLE.

Thank you very much in advance if you are trying to help and answer my question.

Example:

alt text

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
try this:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,)"

that you can test at https://regex101.com/r/TsvivC/1

Ciao.
Giuseppe

0 Karma

mrccasi
Explorer

Hi gcusello,

Thank you but this is not what I'm after. I need to check each row if to see if there are Banana or Peach or Maple in it and get their percentage. Your regex is almost correct but you are not getting some of the fruits in the comments.

Like this one, Assignment details: Peach (40%), Maple (20%), and Banana (40%). You only get the Peach but it's returning the 40%. I need to have a look like this.

Peach Maple Banana
40% 20% 40%

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
In your data I don't see a rule to use for the regex.
If could be acceptable for you, it's possible to take the first word after "Assignment Details: " and the word before percentage with two regexes:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,).*\s+(?<fruit2>\w+)\s+\((?<perc2>\d+\%)"
| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)"

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...