Splunk Search

Look at value ahead of string and table it

ekucevic
Loves-to-Learn Everything

I have events in my logs. I want to capture "temp" and table it
received_time="2021-05-25T15:51:22.181+00:00"] 37 pollAcu20:830 ACU: PSU: Connected: true Output voltage: 4775 0.01V, Output current: 36 0.01A Critical temp: 426 0.1 Deg C Status: 0x3 Fault: false

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

As suggested by the "rex" label, the rex command can help.

... | rex "Critical temp: (?<temp>.*?) Deg"
| table temp
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...