Splunk Search

Regex - Search for Number Range within Array/String

chburnett
New Member

Sample Data:

ID | [[Event1,1435],[Event2,78],[Event3,142]] | etc.....

I'm wanting to build a query which will display the ID and the entire field of event data where 'Event2' is greater than (x).

I'm not overly familiar with regular expressions, so if anyone can point me in the right direction, I'd greatly appreciate it. As it, I'm searching for ([Event2,1] OR [Event2,2] OR [Event2,3] . . .)

I'm trying to optimize my search here, and have had one heck of a time trying to self-instruct myself regex.

0 Karma

sttang88
New Member

Hi,

Try with this:

| rex "
Event1,(?P[0-9]+).*Event2,(?P[0-9]+).*Event3,(?P[0-9]+)"
| search Event2 >

Besides, you should have a look on the Splunk built-in field extractor documentation. This feature allows you to simply extract fields thru the GUI, without any particular knowledge of regex. And here is a website to learn regex: http://regexone.com/lesson

Regards,

0 Karma

javiergn
Super Champion

Hi,

Not sure if this is what you want:

yoursearch
| rex field=_raw "(?<id>\d+) \| (?<events_raw>[^\|]+) \|"
| rex field=events_raw max_match=0 "\,(?<events>\d+)\]"
| eval MyEvent=mvindex(events,1)
| where MyEvent > 50
| table id, events

The regex above will extract all your events as a multifield and then you can use the mv commands to filter when Event X is greater than any given value.

Hope that helps.

Thanks,
J

0 Karma

javiergn
Super Champion

In case you want to try this out first:
https://regex101.com/r/eC1bI0/1
https://regex101.com/r/qP4mY9/1

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...