How do you write rex to extract unstructured field?

[haja4nhn]

I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field.

10/1/2017       0:10:01            all        9.13     0          1.68     6.6       0          82.59
10/1/2017       0:20:01            all        7.46     0          0          5.74     0          85.17
10/1/2017       0:30:01            all        9.05     0          129     1.53     0          88.13
10/1/2017       0:40:01            all        7.77     0          1.45     1.23     0          89.54
10/1/2017       0:50:01            all        7.08     0          1.5       1.41     0          90.02
10/1/2017       1:00:01            all        6.46     0          1.43     1.82     0          90.29
10/1/2017       1:10:01            all        45.4     0          4.2       29.27   0          21.13
10/1/2017       1:20:01            all        61.74   0          4.74     31.19   0          2.32
10/1/2017       1:30:01            all        64.17   0          4.72     26.31   0          4.81
10/1/2017       1:40:01            all        47.54   0          4.23     19.44   0          28.79
10/1/2017       1:50:01            all        44.59   0          3.68     17.47   0          34.27
10/1/2017       2:00:01            all        49.16   0          4.22     13.47   0          33.15
10/1/2017       2:10:01            all        41.98   0          3.95     16.47   0          37.59

Thanks.

[landen99]

Anchor on the word "all",
props.conf

[myst]
EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+)

195 steps. https://regex101.com/r/l2PGs6/2

Change myst to your sourcetype and field1 to your field name.

[lfedak_splunk]

Hey @haja4nhn, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

[s2_splunk]

If you have the option, define your sourcetype for this log source in props.conf and use the FIELD_NAMES / FIELD_DELIMITER to assign the proper field names. Keeps your searches clean... 😉

[cpetterborg]

This is probably the most efficient way to do the field extraction:

^(\S+\s+){5}(?P<field6>\S+)

It requires few steps and has the advantage of being able to extract any data, including strings. It does require that the spaces only be between columns of the data (so no fields that have spaces in them). It's also pretty easy to read and modify.

[haja4nhn]

@cpetterborg

Thanks for your reply.

Let me check this..

[sbbadri]

@haja4nhn

try this,

you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)"

[haja4nhn]

@sbbadri

I have tried this looks like the values are changing. I checking and trying to alter your rex.

Lets see.

Thanks for your help.