Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract the integer values from my sample l...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Everyone,
Could you please anyone help me to extract the Integer values from the below log? Please share the query to extract the seconds value from the logs.
Nov 30, 2016 09:31:04 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[], Integer=[351]
Thanks,
Sridhar
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use your dummy data on regex101 to evaluate your regular expressions.
rex field=_raw ", Integer=\[(?<Integer>\d+)\]"
PS: Once you test across your data, you should move the same as Field Extraction Knowledge Object as that is easier to maintain and reuse. You can do the same via Extract New Fields option during search (Interactive) or from Settings --> Knowledge --> Fields --> Field Extractions or directly editing props.conf.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use your dummy data on regex101 to evaluate your regular expressions.
rex field=_raw ", Integer=\[(?<Integer>\d+)\]"
PS: Once you test across your data, you should move the same as Field Extraction Knowledge Object as that is easier to maintain and reuse. You can do the same via Extract New Fields option during search (Interactive) or from Settings --> Knowledge --> Fields --> Field Extractions or directly editing props.conf.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try please -
| rex field=_raw Integer=\[(?<int_num>\d*)\]
It should create the int_num field.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Build resilience for the agentic era: Join us at Splunk Go San Jose
Manage Edge Processor pipelines end to end with APIs
