Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex to match the price amount in Splunk?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following are my search results
<Total_Amount_Due>122.34</Total_Amount_Due>
<Total_Amount_Due>2.3</Total_Amount_Due>
<Total_Amount_Due>765.33</Total_Amount_Due>
Now Please suggest me a Regex which displays all the amounts.
Thanks in Advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this (may need to adjust the
your current search giving above result | rex field=_raw "\<Total_Amount_Due\>(?<Amount[^\<]+)\<\/Total_Amount_Due\>"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pavanae
I'm glad you've been very active here on Answers and have been getting a lot of help from the community, but I also have noticed that you've been posting a lot of question asking for users to just give you regular expressions for your sample data. Have you been trying to write your regular expressions on your own as well? I'd highly recommend you check out this previous Answers post on the various free regex resources you can look into http://answers.splunk.com/answers/153171/is-there-any-online-regex-tool-to-create-regular-e.html Just a reminder that this is a Q&A forum for Splunk specific topics and not just a place to get regular expressions written for you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok Thanks 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this (may need to adjust the
your current search giving above result | rex field=_raw "\<Total_Amount_Due\>(?<Amount[^\<]+)\<\/Total_Amount_Due\>"
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
