How to extract 3 characters after a given string in Splunk?

[avneet26]

I want to extract the two characters 78 from the barvalue  and have it in a separate column in my table:-

 deltavalue = 890(11%) sigmavalue=334(56%) barvalue=445(78%)

[yuanliu · Accepted solution]

Your title says 3 characters, yet the opening sentence says 2 characters.  Which is it?  Also, are you trying to extract all 2-character strings before the percent sign (%) or only the last one?  Specifics are very important when you ask data questions.

Assuming that you only want the last percentage, you can do

| rex field=barvalue "\(?<barpercent>\d+)%\)"

[avneet26]

Ah my bad. sorry not three characters. only two numbers i want which is 78 

[yuanliu]

In that case, the code provided above should suffice. (You should have a field named barvalue.  Correct?)

[avneet26]

barvalue is the search string in my _raw field. 

[yuanliu]

---

@avneet26 wrote:

barvalue is the search string in my _raw field. 

---

Are you the admin? If not, you should ask them to make sure obvious key-value pairs are extracted; in fact, unless there is any special settings, Splunk extracts "a=b" in _raw as value "b" assigned to field "a". by default.  With that, my first code should give you a new field barpercent.

But if your admin is uncooperative, you can do something like

| rex "barvalue=\d+\((?<barpercent>\d+)%\)"

Hope this helps.