Newbie Splunk Field Extraction Question

[jcman01]

I have a log entry that looks like this. I am talked with coming up with a quick-and-dirty financial report to report net sales. Can someone tell me where to start doing this? Do I build a report and use field extraction? The values I want to look for are, or course, "Net Sales", and then capture the dollar amound after that. I would like to just get a list of the

ThreadName=Thread-2;|12:26:21,680  INFO OrderController:126 - Net sales per order: 362.15

[dmaislin_splunk]

You can make that a permanent field extraction by selecting the specific event and building the extraction with the extract fields from the pull down next to each log line or you can:

create a props.conf for that sourcetype and in it put this in it:

props.conf
[YOURSOURCETYPE]
EXTRACT-myextraction = order:\s(?\d+.?\d+)

Or

create a props.conf and a transforms.conf

props.conf
[YOURSOURCETYPE]
REPORT-myextraction = myfieldextraction

transforms.conf
[myfieldextraction]
REGEX = order:\s(?\d+.?\d+)

[RicoSuave · Accepted solution]

The easiest way to extract that field will be to use the rex command in search. This should give you what you want:

<yoursearch> | rex field=_raw "order:\s(?<netsales>\d+.?\d+)"

That should extract that dollar amount into a field called netsales. This is assuming that the dollar amount is always preceded by order:

[ptanner]

This usually works. However, it wouldn't extract anything with an input like

ThreadName=Thread-2;|12:26:21,680 INFO OrderController:126 - Net sales per order: 3

since the regex asks for at least two digits. Also, you need to escape the point. Maybe something like this would be better:

| rex field=_raw "order:\s+(?\d+(?:\.\d+)?)"

This allows for an arbitrary number (>0) of whitespaces.