Splunk Search

How to edit my regular expression to extract the numbers and semicolons from my sample data?

ayusuf
Engager

I don't understand how Splunk does regex!
I have this search below:

...
| spath output=test path=a.b.c
| rex field=test "?<test1>[0-9]+"
| table test, test1

Test is this: {"timehours":"16","timeminutes":"34","timeseconds":"11"}

How do I extract just the numbers and semicolon except the first semicolon?
Thanks!

0 Karma
1 Solution

sundareshr
Legend

Try this

 ...
 | spath output=test path=a.b.c
 | rex max_match=3 field=test "(?<t>\d{1,2})"
 | eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
 | table test, test1

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Here's another way. Still couldn't get it in just one rex.

This generates test results -

| makeresults | eval testfield="{\"timehours\":\"16\",\"timeminutes\":\"34\",\"timeseconds\":\"11\"}" 

This pulls out the time parts -

| rex field=testfield max_match=3 "(?<mytime>\d{1,2})" | eval mytime=mvjoin(mytime,":")
0 Karma

sundareshr
Legend

Try this

 ...
 | spath output=test path=a.b.c
 | rex max_match=3 field=test "(?<t>\d{1,2})"
 | eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
 | table test, test1
0 Karma

ayusuf
Engager

That works but is there a way to do it all in rex? Thanks.

0 Karma

sundareshr
Legend

With rex mode=sed you cannot assign the result to a different field. Try this

  ... | rex mode=sed field=test "s/{\"timehours\":\"(\d+).+?:\"(\d+).+?:\"(\d+)\"}/\1:\2:\3/g" | table test
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>