Splunk Search

How to extract string from a paragraph?

ppanchal
Path Finder

Hi,
Below is my paragraph and I want to extract the routeorder value from the paragraph.

Please assist.

other_app_launch_data:   Third Party App Launch Data:354736071554019 Data passed:Bundle{service_url : http://example.com/service; site_number : S04136; vehicle_id : 210648; driver_id : 082775; pre_post : post; tabletid : 354736071554019; first_name : Gennadiy; environment : Production; fuel : ; route_id : ***ROUTEORDER#**158682677**;*** device_id : 354736071554019; DVIR_RESPONSE_ACTION : DVIR_POST_CHECK_RESPONSE; meter_time : 717; meter_distance : 161724; last_name : Trofimchik;  }Bundle reqCode:9804
0 Karma
1 Solution

sudosplunk
Motivator

Hi there,

Try this,

your_search | rex field=_raw "route_id\s\:\s\w+\#(?<ROUTEORDER>\d+)"

View solution in original post

0 Karma

sudosplunk
Motivator

Hi there,

Try this,

your_search | rex field=_raw "route_id\s\:\s\w+\#(?<ROUTEORDER>\d+)"
0 Karma

ppanchal
Path Finder

No this did not work. I am not getting anything with the search.

0 Karma

sudosplunk
Motivator

Is it giving any error? Are able to see ROUTEORDER field under interesting fields section? Also, can you paste a screenshot of data along with your search.

0 Karma

ppanchal
Path Finder

yes, i got it thanks.

0 Karma

sudosplunk
Motivator

Great. Please accept the answer if it helped you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...