Splunk Search

Look at value ahead of string and table it

ekucevic
Loves-to-Learn Everything

I have events in my logs. I want to capture "temp" and table it
received_time="2021-05-25T15:51:22.181+00:00"] 37 pollAcu20:830 ACU: PSU: Connected: true Output voltage: 4775 0.01V, Output current: 36 0.01A Critical temp: 426 0.1 Deg C Status: 0x3 Fault: false

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

As suggested by the "rex" label, the rex command can help.

... | rex "Critical temp: (?<temp>.*?) Deg"
| table temp
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...