- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Pulling Last Integer Value from Unlabeled Field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, this is a 3-line sample of my data: What I'm trying to do is get ahold of the last two fields (524288000 and 188077720 in line 1) so I can plot their trends in a graph. How would I go about doing this? I've looked into extract(kv) and kvform and have some limited experience in rex fields, but I'm pretty new to this so any help would be appreciated. Thank you!
34 Mon May 19 13:00:09 EDT 2014 271764960 1 PS MarkSweep 0 0.0 0 0.0 524288000 524288000 524288000 188077720
34 Mon May 19 13:00:09 EDT 2014 271764990 2 PS MarkSweep 0 0.0 0 0.0 521666560 524288000 521666560 186098608
34 Mon May 19 13:00:09 EDT 2014 271764995 3 PS MarkSweep 0 0.0 0 0.0 523763712 524288000 523763712 147496952
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should use rex.
your search that produced this output | rex "(?P<firstnumber>\d+)\s+(?P<secondnumber>\d+)$"
The above search should create two new fields called firstnumber and secondnumber.
Edited to include a closing quote.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should use rex.
your search that produced this output | rex "(?P<firstnumber>\d+)\s+(?P<secondnumber>\d+)$"
The above search should create two new fields called firstnumber and secondnumber.
Edited to include a closing quote.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The $ means "the end of the line", so in this case it give regex an anchor - it tells regex to basically look backwards from the end of the line. The ^ is the symbol for the beginning of the line.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, you guys were right! If you don't mind me asking, what does the $ command do? I'd love to understand a little how these results are being found
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you miss the "$" sign from the regex?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you forgot the $ at the end.
rex "(?P<firstnumber>\d+)\s+(?P<secondnumber>\d+)\s+(?P<thirdnumber>\d+)\s+(?P<fourthnumber>\d+)\s+(?P<fifthnumber>\d+)$"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the help!
I tried using the rex command
rex "(?P<firstnumber>\d+)\s+(?P<secondnumber>\d+)\s+(?P<thirdnumber>\d+)\s+(?P<fourthnumber>\d+)\s+(?P<fifthnumber>\d+)"
On this search, but I'm getting some weird behavior. In the above example, firstnumber is 19 (as in May 19), secondnumber is 13 (the hour), thirdnumber is 1, 2, or 3 for the respective line, fourthnumber is 524288000, 521666560, 523763712, and fifthnumber is 188077720, 186098608,147496952. As you can see, I'm getting the 4th-to-last as fourthnumber and then skipping to the last for fifthnumber, do you know why?
Enterprise Security Content Update (ESCU) | New Releases
Index This | Divide 100 by half. What do you get?
Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!
