Splunk Search

How do you extract the value of output quality from the log below?

abhishekgandhe
Explorer

I want to extract the value of Output Quality from the below log.

Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

Output Quality is 0.0%. I want to extract this value. How do you do it with regex?

Tags (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Update- included the max_match -

| makeresults | eval logs = "batchId ==>ceba8481-7806-4b03-a8c9-811bdc340a05==true :: Output Quality 7.2%
batchId ==>04b0800f-74e2-4522-bfd0-9621af9d4536==true :: Output Quality 9.5%
batchId ==>d66872a1-4cf7-433c-a86d-d7ac097537d8==true :: Output Quality 34.28%
batchId ==>3d4606ec-f607-4187-9f58-47d88f99ac0a==true :: Output Quality 90.34%"
 | rex field=logs max_match=0 "Output Quality (?P<Quality>\d+\.\d+\%)" | table Quality logs

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Update- included the max_match -

| makeresults | eval logs = "batchId ==>ceba8481-7806-4b03-a8c9-811bdc340a05==true :: Output Quality 7.2%
batchId ==>04b0800f-74e2-4522-bfd0-9621af9d4536==true :: Output Quality 9.5%
batchId ==>d66872a1-4cf7-433c-a86d-d7ac097537d8==true :: Output Quality 34.28%
batchId ==>3d4606ec-f607-4187-9f58-47d88f99ac0a==true :: Output Quality 90.34%"
 | rex field=logs max_match=0 "Output Quality (?P<Quality>\d+\.\d+\%)" | table Quality logs

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

abhishekgandhe
Explorer

I just don't have 4 lines, but there are multiple lines. How to write one REGEX.
I tried below REGEX, but could not got the desired result.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" "batchId ==>""==true :: Output Quality" | rex field=logs max_match=0 "Output Quality (?P\d+.\d+\%)" | table Quality

0 Karma

inventsekar
SplunkTrust
SplunkTrust

rex field=logs max_match=0

You should use the field which contains the logs.. or "_raw"

rex field=_raw max_match=0

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...