Splunk Search

Rex removing a sub string is not working?

johnnybillyd
Explorer

Hi,

Been banging my head on this brick wall for a while so reaching out for some of expertise. Seems pretty straightforward and regex101 says my expression should work, but I am not getting any data returned in the new field.

Original data  is:

18 dB, 16 dB, 12 dB, 12 dB, 12 dB, 13 dB, 4 dB, 8 dB, 9 dB, 9 dB
9 dB, 9 dB, 9 dB, 9 dB
9 dB
9 dB, 9 dB, 9 dB, 9 dB, 9 dB
7 dB, 9 dB

I'm trying to remove the space and the text dB after any number. So the results for the 4th event would read as 9, 9, 9, 9, 9 and the 5th event would be 7, 9

My search returns  the events, but no values for the new field:

|rex field=Value "\ dB(?<MicGainText>)"
|table Value MicGainText

If anyone could assist, it would be greatly appreciated. Thanks in advance

John

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @johnnybillyd ,

sorry, please try this:

 

<your_search>
| rex field=Value max_match=0 "(?<MicGainText>\d+)\sdB"
| table Value MicGainText

 

that you can test at https://regex101.com/r/y9tTUs/1

Ciao.

Giuseppe

View solution in original post

johnnybillyd
Explorer

Hi @gcusello 

 

Thank you very much, that is now working!

 

It is stripping the comma delimiter, and stacking the values in the table, but I think I will be able to sort that out now  you have helped me get the basic rex working though.

 

Thanks again.

Kudos,

Regards,

John

0 Karma

johnnybillyd
Explorer

Hi @gcusello

Thanks for responding.

Unfortunately, that's still not returning any results for the MicGainText field. 

Cheers,

John

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @johnnybillyd ,

sorry, please try this:

 

<your_search>
| rex field=Value max_match=0 "(?<MicGainText>\d+)\sdB"
| table Value MicGainText

 

that you can test at https://regex101.com/r/y9tTUs/1

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @johnnybillyd,

probably the regex you shared isn't complete, but it should be:

<your_search>
| rex field=Value max_match=0 "dB(?<MicGainText>\d+)"
| table Value MicGainText

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...