Splunk Search

Help with regex in getting the value out of a certain word

mrccasi
Explorer

Hi everyone. Im not very good in doing regex. I would like to ask for you help here. The situation is to get a certain value based on the given word. The value does not have a format and very messy.

Below picture is the sample that I need. The regex needs to get the certain word and the next close and open parenthesis with percentage needed to be in the new field "(00%)" . Please see the picture below for the sample data.

Need to get the word Peach and the next (00%) to get will go to "Peach %". Same with other work like Banana//BANANA and Maple/MAPLE.

Thank you very much in advance if you are trying to help and answer my question.

Example:

alt text

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
try this:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,)"

that you can test at https://regex101.com/r/TsvivC/1

Ciao.
Giuseppe

0 Karma

mrccasi
Explorer

Hi gcusello,

Thank you but this is not what I'm after. I need to check each row if to see if there are Banana or Peach or Maple in it and get their percentage. Your regex is almost correct but you are not getting some of the fruits in the comments.

Like this one, Assignment details: Peach (40%), Maple (20%), and Banana (40%). You only get the Peach but it's returning the 40%. I need to have a look like this.

Peach Maple Banana
40% 20% 40%

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mrccasi,
In your data I don't see a rule to use for the regex.
If could be acceptable for you, it's possible to take the first word after "Assignment Details: " and the word before percentage with two regexes:

| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)(\s+|,).*\s+(?<fruit2>\w+)\s+\((?<perc2>\d+\%)"
| rex field=Comments "((Assignment Details)|(Assignment details)):\s+(?<fruit>[^-]*)[^\(]*\((?<perc>\d+\%)\)"

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...