Splunk Search

How to extract particular value using regular expression?

chetanhonnavile
Explorer

In the below event "status" key has the value either "1" or "0" . I am looking out to extract those "status" having the value "0" and put them in a field

please help me out in getting a regular expression for this.

2017-02-14 18:47:28.572 INFO  SomePlaceHolder-5 [.abc.def.nothingishere]  - string response: <200 OK,{"clips":[{"myid":"123456","historyid":"777-888-999","provider":"somecompany","status":1,"userType":1}]},{X-Backside-Transport=[OK OK], Connection=[Keep-Alive], Transfer-Encoding=[chunked], Content-Type=[application/json], X-Powered-By=[ARR/3.0,ASP.NET], Date=[Tue, 14 Feb 2017 18:47:28 GMT], X-Client-IP=[10.0.0.0.], X-Global-Transaction-ID=[9876543]}>
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Something like this, perhaps?

index=foo | regex "\"status\":0" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Something like this, perhaps?

index=foo | regex "\"status\":0" | ...
---
If this reply helps you, Karma would be appreciated.

chetanhonnavile
Explorer

this is working...thanks!

now i am trying to put them in a field.

0 Karma

DalJeanis
Legend

Put precisely WHAT in a field?

0 Karma

chetanhonnavile
Explorer

well this solution looks like regular regex.

i am finding difficulty in understanding the 'rex' conventions used in splunk ,any good explanatory document at your end ?

0 Karma

gvmorley
Contributor

Have a read of the section regarding 'named capture groups' here:

http://www.regular-expressions.info/named.html

This should be a good starting point to see how the rex command (not the regex command), can be used to create field / value pairs.

Building on the great answers above, think of it like this.

Find the part of your string which you want to match, then wrap it in brackets.

So if you wanted to find the digit after "status": you could write:

"\"status\":(\d)"

Now if you want to give that a field name (lets call it 'status_value') using rex, you could do:

"\"status\":(?<status_value>\d)"

In Splunk, you should now have a field called 'status_value' containing the digit from your event.

But the http://www.regular-expressions.info site is a great place to read up on regex in general.

cpetterborg
SplunkTrust
SplunkTrust

Do you only want the ones with 0 as the value? This is the general solution:

... | rex "\"state\":(?P<status>\d),"

chetanhonnavile
Explorer

yeah,looking for only status:0

well the query you provided gives me the same number of events combining both 0's and 1's.

if i am filtering it for only 0's then the event count will be too small.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you just want a count, you can do this:

 ... | rex "\"state\":(?P<status>\d)," | search status=0 | stats count 

or this:

 ... | rex "\"state\":(?P<status>0)," | where status=* | stats count
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...