Splunk Search

How do you extract a field value with regex?

sarit_s
Communicator

Hello,

I have an event that looks like :

> <18> 20/02/19 22:23:59 : Maintenance counter "Digital Materials Mode" Value is: 84 hours.

i need to extract the Maintenance counter type (the string between ""), the value and the value type (in the example its hours, can be minutes, days, etc)

The maintenance counter type can be 2 words, 3, 4, etc..

I tried this regex, but it is returning me only events with maintenance counter type that contains 3 words :

index="emea_pj" "Maintenance counter" | rex field=_raw "(?ms)^(?:[^ \\n]* ){6}(?P<MaintenanceCounter>\"\\w+\\s+\\w+\\s+\\w+\")" 

How can I achieve my goal?

thanks

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

try this anywhere:

| makeresults count=1 
| eval data = "20/02/19 22:23:59 : Maintenance counter \"Digital Materials Mode\" Value is: 84 hours.;;;20/02/19 22:24:59 : Maintenance counter \"Another Counter\" Value is: 74 seconds.;;;20/02/19 22:25:59 : Maintenance counter \"Counter\" Value is: 64 minutes."
| makemv delim=";;;" data
| mvexpand data
| table data
| rename COMMENT as "above generates fake results, belew is your solution" 
| rex field=data "(?<timestamp>\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s\:\sMaintenance\scounter\s\"(?<counter>[^\"]+)\"\sValue\sis\:\s(?<value>\d+)\s(?<value_counter>[^\.]+)"

screenshot:
alt text

View solution in original post

0 Karma

adonio
Ultra Champion

try this anywhere:

| makeresults count=1 
| eval data = "20/02/19 22:23:59 : Maintenance counter \"Digital Materials Mode\" Value is: 84 hours.;;;20/02/19 22:24:59 : Maintenance counter \"Another Counter\" Value is: 74 seconds.;;;20/02/19 22:25:59 : Maintenance counter \"Counter\" Value is: 64 minutes."
| makemv delim=";;;" data
| mvexpand data
| table data
| rename COMMENT as "above generates fake results, belew is your solution" 
| rex field=data "(?<timestamp>\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s\:\sMaintenance\scounter\s\"(?<counter>[^\"]+)\"\sValue\sis\:\s(?<value>\d+)\s(?<value_counter>[^\.]+)"

screenshot:
alt text

0 Karma

sarit_s
Communicator

when running the rex its returning result but if im running it with table it showing no results

index="emea_pj" "Maintenance counter" |SerialNumber| rex field=data "(?\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2})\s:\sMaintenance\scounter\s\"(?[^\"]+)\"\sValue\sis:\s(?\d+)\s(?[^.]+)" |table data

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...