Splunk Search

How do you write rex to extract unstructured field?

New Member

I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field.

10/1/2017       0:10:01            all        9.13     0          1.68     6.6       0          82.59
10/1/2017       0:20:01            all        7.46     0          0          5.74     0          85.17
10/1/2017       0:30:01            all        9.05     0          129     1.53     0          88.13
10/1/2017       0:40:01            all        7.77     0          1.45     1.23     0          89.54
10/1/2017       0:50:01            all        7.08     0          1.5       1.41     0          90.02
10/1/2017       1:00:01            all        6.46     0          1.43     1.82     0          90.29
10/1/2017       1:10:01            all        45.4     0          4.2       29.27   0          21.13
10/1/2017       1:20:01            all        61.74   0          4.74     31.19   0          2.32
10/1/2017       1:30:01            all        64.17   0          4.72     26.31   0          4.81
10/1/2017       1:40:01            all        47.54   0          4.23     19.44   0          28.79
10/1/2017       1:50:01            all        44.59   0          3.68     17.47   0          34.27
10/1/2017       2:00:01            all        49.16   0          4.22     13.47   0          33.15
10/1/2017       2:10:01            all        41.98   0          3.95     16.47   0          37.59

Thanks.

0 Karma

Motivator

Anchor on the word "all",
props.conf

[myst]
EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+)

195 steps. https://regex101.com/r/l2PGs6/2

Change myst to your sourcetype and field1 to your field name.

0 Karma

Splunk Employee
Splunk Employee

Hey @haja4nhn, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

Splunk Employee
Splunk Employee

If you have the option, define your sourcetype for this log source in props.conf and use the FIELDNAMES / FIELDDELIMITER to assign the proper field names. Keeps your searches clean... 😉

SplunkTrust
SplunkTrust

This is probably the most efficient way to do the field extraction:

^(\S+\s+){5}(?P<field6>\S+)

It requires few steps and has the advantage of being able to extract any data, including strings. It does require that the spaces only be between columns of the data (so no fields that have spaces in them). It's also pretty easy to read and modify.

New Member

@cpetterborg

Thanks for your reply.

Let me check this..

0 Karma

Motivator

@haja4nhn

try this,

you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)"

0 Karma

New Member

@sbbadri

I have tried this looks like the values are changing. I checking and trying to alter your rex.

Lets see.

Thanks for your help.

0 Karma