Splunk Search

How to extract value under double quotes using the rex command?

saravanafd
Explorer

Has been busy for "639" seconds

using rex command i need to extract value 639 and store it in one field.

Please help !!!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex "busy for \"(?<one>\d+)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval msg ="busy for \"639\" seconds" 
| rex field=msg "\"(?P<seconds>[\d]+)\""
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex "busy for \"(?<one>\d+)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

saravanafd
Explorer

Thank you very much for the resolution. Works perfectly 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...