Splunk Search

How to extract this value from pipe delimited fields in Splunk?

prategup1
New Member

Hi All

My search results from Splunk look like below

2015-11-13 06:32:33,949|a.abcd|DAS|callabcd():getTime|0.296|SUCCESS|Data : 254|1447414015145[B@8d7c046b8089602570758821847|null|null

I want to extract the value 0.296 from this. Can you please let me know how to do this? I have already tried with below options and it doesn't work.

Option 1:

search_query  | rex field=_raw "^([^|]+|){5} +(?<x>[^|]+)"| table x

Option 2:

search_query  | rex field=_raw "^([^\|]+\|){5} +(?<x>[^\|]+)"| table x
0 Karma

sundareshr
Legend

Will it always be a decimal number? If it will be, you can use this \|(\d\.\d+) Alternately, you could setup field extractions and specify | the delim.

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...