Splunk Search

How to extract this value from pipe delimited fields in Splunk?

prategup1
New Member

Hi All

My search results from Splunk look like below

2015-11-13 06:32:33,949|a.abcd|DAS|callabcd():getTime|0.296|SUCCESS|Data : 254|1447414015145[B@8d7c046b8089602570758821847|null|null

I want to extract the value 0.296 from this. Can you please let me know how to do this? I have already tried with below options and it doesn't work.

Option 1:

search_query  | rex field=_raw "^([^|]+|){5} +(?<x>[^|]+)"| table x

Option 2:

search_query  | rex field=_raw "^([^\|]+\|){5} +(?<x>[^\|]+)"| table x
0 Karma

sundareshr
Legend

Will it always be a decimal number? If it will be, you can use this \|(\d\.\d+) Alternately, you could setup field extractions and specify | the delim.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...