Splunk Search

How to extract values from existing field and reassign them to field?

wts408
Explorer

Hello,

I currently have a field that contains a long string over 100+ events and in that field there are varying file sizes (609.9 KB, 1GB, 300B, etc.). What I would like to do is come up with an eval or rex command that will pull out only the file sizes and place them into a new field called File_Size. I tried using the field extractor via the GUI, but it would only pick up a couple of the file sizes and even then still wouldn’t show up in the available fields of my search. I’ve also tried creating different queries, but can’t seem to get capture groups set correctly. Can someone please advise on best approach?

Labels (2)
0 Karma
1 Solution

wts408
Explorer

@gcusello - I did some tinkering and came up with the solution! 

mysearch... | rex field=_raw "FileSize: (?<File_Size>\d*.\d*\s*\w*)"

This gave me what I was looking for, which captured all of the different file sizes and the corresponding units (MB, GB, etc.).

Thanks for pointing me in the right direction!!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wts408,

you could extract the field using the regex and then use the eval coalesce, something like this:

<your_search>
| rex field=File_Size "..File_Size1.."
| eval File_Size=coalesce(File_Size1,File_Size)
| ...

Ciao.

Giuseppe

0 Karma

wts408
Explorer

@gcusello - so where you say “..File_Size1..” I should put one of the actual file sizes there? I’ve tried that, but I just get an error saying the regex “xyz” does not extract anything. It should specify at least one named group. Format: (?<name>..). Thoughts?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wts408,

Sorry I wasn't so clear!

I haven't your logs so I cannot give you the correct regex to use.

With my answer I  was saying: make a regex extraction using a different name for the extracted field File_Size1, so you can use it in the following coalesce command.

Ciao.

Giuseppe

0 Karma

wts408
Explorer

@gcusello - I did some tinkering and came up with the solution! 

mysearch... | rex field=_raw "FileSize: (?<File_Size>\d*.\d*\s*\w*)"

This gave me what I was looking for, which captured all of the different file sizes and the corresponding units (MB, GB, etc.).

Thanks for pointing me in the right direction!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wts408,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...