Splunk Search

How to extract a float value from 2 strings?

alangularte
New Member

How can I get all the float values that are between the strings "totalElapsedTime^" and "^" from the log sample bellow?

2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://schemas.dell.com/services/isp/assetheadersearch/03/1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipel... null

Tags (2)
0 Karma

TISKAR
Builder

Hello @alangularte, Can you try this:

| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0

For example:

| makeresults 
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[\d.]*)"  max_match=0
0 Karma

DalJeanis
Legend

Looks like you basically just need a rex.

| rex max_match=0 "\^(?<fieldname>\w+)\^(?<fieldvalue>[0-9.]+)(?=\^)"

This will extract every copy into two multivalue fields. I'm not clear whether your example is two different events, or if you needed the first or second set of data. If you need both, then you have an ambiguity issue due to repeating the same names.

The next step would be stitching each pair together and then using mvexpand to create single records, then assigning the fieldvalues to the fieldnames.

I'll hold off making code for that until you describe what you need to do with the data.

0 Karma

niketn
Legend

@alangularte, please try out the following rex command:

 <yourBaseSearch>
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0

Following is a run anywhere search based on the the sample data provided:

| makeresults
| eval _raw="2018-04-21 19:57:26,189 INFO - Sat Apr 21 19:57:26 CDT 2018 ID:<48949.1524358646183.0> xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns=\"http://schemas.dell.com/services/isp/assetheadersearch/03/1.0\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully\">http://www.w3.org/2001/XMLSchema-instance\"/>^totalElapsedTime^0.74^CallElapsedTime^0.67^RequestPipelineElapsedTime^0.02^ResponsePipelineElapsedTime^0.04^RequestTransformationElapsedTime^0^ResponseTransformationElapsedTime^0.04^payloadSize^1047^appName^^Result^CompletedSuccessfully null"
| rex "totalElapsedTime\^(?<totalElapsedTime>[^\^]+)\^" max_match=0
| table totalElapsedTime _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...