Splunk Search

How to extract values?

valpravin
Engager

My Log Contains

"SeqNo":4433221,"T_CODE":"ABC","VALUE":983123456,"VALUE2":"0000000000",

I am in need of VALUE field which will display 983123456 as an output tried with this query

|rex VALUE="(?[^\d*])" |table VALUE

please help

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw= "\"SeqNo\":4433221,\"T_CODE\":\"ABC\",\"VALUE\":983123456,\"VALUE2\":\"0000000000\","

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| rex max_match=0 "(?<KEY_1>[^:\"]+)\"?:\"?(?<VAL_1>[^:\"]+)\"?,"
| eval _raw = mvzip(KEY_1, VAL_1, "=")
| kv

I named them this way for a reason; search for _KEY_1 on this page:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp= "\"SeqNo\":4433221,\"T_CODE\":\"ABC\",\"VALUE\":983123456,\"VALUE2\":\"0000000000\", "
|rex field=temp "VALUE\"\:(?P<value>\d+)"
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...