Splunk Search

How do I extract the following fields using the rex command?

maheshsat
Explorer

I want to extract Balance (Entered)="10008.1311701944" and Balance (Functional)="11648.1319999944" fields from below logs

Log:

GL Test="000000", GL Test2="0000", Balance Type="Debit", Balance (Entered)="10008.1311701944", Balance (Functional)="11648.1311701944"

Command:

index=test sourcetype="test" | rex field=_raw ".*\w+\s+\w+\=\"\d+\.\d+\"\s+[?\w+\s+\w+\"\d+\"\,\s+\w+]\s+\w+.*"
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hello.

How about

<your search...> | rex "Balance \(Entered\)=\"(?<balance_entered>[^\"]+).+Balance \(Functional\)\=\"(?<balance_functional>[^\"]+)"

By the way I used the website regex101.com to debug this

View solution in original post

0 Karma

burwell
SplunkTrust
SplunkTrust

Hello.

How about

<your search...> | rex "Balance \(Entered\)=\"(?<balance_entered>[^\"]+).+Balance \(Functional\)\=\"(?<balance_functional>[^\"]+)"

By the way I used the website regex101.com to debug this

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!