Splunk Search

How do you write rex to extract unstructured field?

haja4nhn
New Member

I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field.

10/1/2017       0:10:01            all        9.13     0          1.68     6.6       0          82.59
10/1/2017       0:20:01            all        7.46     0          0          5.74     0          85.17
10/1/2017       0:30:01            all        9.05     0          129     1.53     0          88.13
10/1/2017       0:40:01            all        7.77     0          1.45     1.23     0          89.54
10/1/2017       0:50:01            all        7.08     0          1.5       1.41     0          90.02
10/1/2017       1:00:01            all        6.46     0          1.43     1.82     0          90.29
10/1/2017       1:10:01            all        45.4     0          4.2       29.27   0          21.13
10/1/2017       1:20:01            all        61.74   0          4.74     31.19   0          2.32
10/1/2017       1:30:01            all        64.17   0          4.72     26.31   0          4.81
10/1/2017       1:40:01            all        47.54   0          4.23     19.44   0          28.79
10/1/2017       1:50:01            all        44.59   0          3.68     17.47   0          34.27
10/1/2017       2:00:01            all        49.16   0          4.22     13.47   0          33.15
10/1/2017       2:10:01            all        41.98   0          3.95     16.47   0          37.59

Thanks.

0 Karma

landen99
Motivator

Anchor on the word "all",
props.conf

[myst]
EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+)

195 steps. https://regex101.com/r/l2PGs6/2

Change myst to your sourcetype and field1 to your field name.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @haja4nhn, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

If you have the option, define your sourcetype for this log source in props.conf and use the FIELD_NAMES / FIELD_DELIMITER to assign the proper field names. Keeps your searches clean... 😉

cpetterborg
SplunkTrust
SplunkTrust

This is probably the most efficient way to do the field extraction:

^(\S+\s+){5}(?P<field6>\S+)

It requires few steps and has the advantage of being able to extract any data, including strings. It does require that the spaces only be between columns of the data (so no fields that have spaces in them). It's also pretty easy to read and modify.

haja4nhn
New Member

@cpetterborg

Thanks for your reply.

Let me check this..

0 Karma

sbbadri
Motivator

@haja4nhn

try this,

you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)"

0 Karma

haja4nhn
New Member

@sbbadri

I have tried this looks like the values are changing. I checking and trying to alter your rex.

Lets see.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...