Splunk Search

How do I extract numerical value from within a string using rex command?

Builder

Hello,

I've been reading up on the rex command and using it to split strings, but I cannot for the life of me get it working. I have the following input:

FORECAST
Sun and a few passing clouds. High 13C. Winds light and variable.
Partly cloudy. Low 4C. Winds light and variable.
Overcast with rain showers at times. High around 10C. Winds NE at 10 to 15 km/h. Chance of rain 60%.
Cloudy skies. Low 2C. Winds ENE at 10 to 15 km/h.
Partly cloudy skies. High 6C. Winds light and variable.
A mostly clear sky. Low -1C. Winds light and variable.
A mainly sunny sky. High 6C. Winds light and variable.
A mostly clear sky. Low near 0C. Winds light and variable.

and my goal is to extract the temperature value into a new field FORECAST_C. I basically have to remove everything up until the space between the date, and everything after starting with "C.". My desired output is:

FORECAST_C
13
4
10
2
6
-1
6
0

I've come up with

rex field=entry ".\s(<FORECAST_C>.*)C\w."

but it's clearly not working...

Can somebody give me a hand?

Thanks!

Andrew

0 Karma
1 Solution

Motivator

If every line is an event try this:

your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If more than one lines are in per event try max_match=0 in it:

your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If the data in question is in field=entry then you can use that field as well in the above commands rather than field=_raw.

See extraction here.

View solution in original post

Motivator

If every line is an event try this:

your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If more than one lines are in per event try max_match=0 in it:

your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If the data in question is in field=entry then you can use that field as well in the above commands rather than field=_raw.

See extraction here.

View solution in original post

Builder

Exactly that! I saw that you revised your answer since I was about to say that I added the \s so that it would take everything after the space, but I see you caught that already!

Thank you!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!