Splunk Search

How extract field and value using rex?

karthi2809
Builder

29-Mar-2023 04:56:35:PM: |CPU Utilization % Average ------- 11

 

Expected result:

11

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<expected>\d+)$"
0 Karma

karthi2809
Builder

@ITWhisperer 

rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4

 

expected result

41.4

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you move the goal posts by providing different examples, you can expect the solution to break. Try something like this (based on the two examples given so far!)

| rex "(?<expected>[\d\.]+)$"
Get Updates on the Splunk Community!

Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to ...

From Product Design to User Insights: Boosting App Developer Identity on Splunkbase

co-authored by Yiyun Zhu & Dan Hosaka Engaging with the Community at .conf24 At .conf24, we revitalized the ...

Detect and Resolve Issues in a Kubernetes Environment

We’ve gone through common problems one can encounter in a Kubernetes environment, their impacts, and the ...