Splunk Search
Highlighted

How to extract this value from pipe delimited fields in Splunk?

New Member

Hi All

My search results from Splunk look like below

2015-11-13 06:32:33,949|a.abcd|DAS|callabcd():getTime|0.296|SUCCESS|Data : 254|1447414015145[B@8d7c046b8089602570758821847|null|null

I want to extract the value 0.296 from this. Can you please let me know how to do this? I have already tried with below options and it doesn't work.

Option 1:

search_query  | rex field=_raw "^([^|]+|){5} +(?<x>[^|]+)"| table x

Option 2:

search_query  | rex field=_raw "^([^\|]+\|){5} +(?<x>[^\|]+)"| table x
0 Karma
Highlighted

Re: How to extract this value from pipe delimited fields in Splunk?

Legend

Will it always be a decimal number? If it will be, you can use this \|(\d\.\d+) Alternately, you could setup field extractions and specify | the delim.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.