Splunk Search

How do you use the rex command to calculate a value?

Danielle2018V
New Member

Hello,

I'm new to Splunk and I have the following field and want to grab the subtotal of the field total using the rex_raw field.

This is the field in the log file

 "total"=>"$37.05",

This is the code I wrote any idea why it's not working?

index="test" "Splunktest" "Refund succeeded" "current_cty_domain : US"  | rex  field=_raw "total\"=>\"$\"(?<refund_amount>.*)\"" | stats sum(refund_amount) as amount_refunded
Tags (2)
0 Karma
1 Solution

darrenfuller
Contributor

Hey..

You didn't make any fields in your regular expression. For rex to work you need to have a regular expression with at least one named capture group like: (?pattern)

try something like:

index="test" "Splunktest" "Refund succeeded" "current_cty_domain : US" 
| rex field=_raw "total\"=>\"$(?<refund_amount>[^\"]+)\"" 
| stats sum(refund_amount) as amount_refunded

View solution in original post

0 Karma

Danielle2018V
New Member

I was able to get it to work with a combination of all answers above.

rex field=_raw "total\"=>\"-\$(?[^\"]+)\""

0 Karma

somesoni2
Revered Legend

Try this

index="test" "Splunktest" "Refund succeeded" "current_cty_domain : US" 
| rex  field=_raw "total\"\=\>\"\$(?<refund_amount>.*)\""
 | stats sum(refund_amount) as amount_refunded

See this runanywhere sample search

| gentimes start=-1 | eval _raw="Somes other test  \"total\"=>\"$37.05\", more text" | table _raw | rex  field=_raw "total\"\=\>\"\$(?<refund_amount>.*)\""
0 Karma

Danielle2018V
New Member

I tried this also and got the same result, Is the rex command the most appropriate solution to gather a subtotal of the total field?

Below sample log data

$0.00", "raw_discount"=>0, "shipping_cost"=>"$0.00", "shipping_total"=>0, "tax"=>"$3.00", "occupancy_tax"=>nil, "tip"=>nil, "goods_customs_duty"=>"$0.00", "tax_total"=>3.0, "partial_refund"=>nil, "gift_wrapped_item_count_display"=>"(0)", "gift_wrap_fee_total"=>"$0.00", "total"=>"$52.99", "raw_total"=>52.99, "currency_code"=>"$", "collected"=>0, "collected_cash"=>0, "collected_bucks"=>0, "collected_exchange

0 Karma

ddrillic
Ultra Champion

Something like - "total"=>\$(?<sum>.*)

alt text

0 Karma

darrenfuller
Contributor

Hey..

You didn't make any fields in your regular expression. For rex to work you need to have a regular expression with at least one named capture group like: (?pattern)

try something like:

index="test" "Splunktest" "Refund succeeded" "current_cty_domain : US" 
| rex field=_raw "total\"=>\"$(?<refund_amount>[^\"]+)\"" 
| stats sum(refund_amount) as amount_refunded
0 Karma

Danielle2018V
New Member

Thanks everyone for the speedy responses. I tried all three suggestions but still received the same error "no results found". Below is a sample of the log file. You can see that the total is $52.99 but still no results were found.Is the rex command the most appropriate solution to gather a subtotal of the total field?

Thanks

"$0.00", "raw_discount"=>0, "shipping_cost"=>"$0.00", "shipping_total"=>0, "tax"=>"$3.00", "occupancy_tax"=>nil, "tip"=>nil, "goods_customs_duty"=>"$0.00", "tax_total"=>3.0, "partial_refund"=>nil, "gift_wrapped_item_count_display"=>"(0)", "gift_wrap_fee_total"=>"$0.00", "total"=>"$52.99", "raw_total"=>52.99, "currency_code"=>"$", "collected"=>0, "collected_cash"=>0, "collected_bucks"=>0, "collected_exchange

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...