Splunk Search

Splunk Query

DTERM
Contributor

I'm trying to extract a single field from a log and perform some statistical calculations using stats.

The log entries I have look like the following:

"Jan 22 16:43:48 10.164.93.7 10.164.93.7 local2 warn rpd[1106]: RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp B.R2.CHI-1) bandwidth changed, path bandwidth 81659056 bps","2013-01-22T11:43:48.000-0500",,16,22,43,january,48,tuesday,2013,local,"nix-all-logs",local2,"log.itgh.net",,"syslog_prod",1,22,"C-NET","10.164.93.7","10.164.93.7","R1.BB-FO.BRN1",Jan,"16:43:48","RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp R1.CHI2-1) bandwidth changed, path bandwidth 81659056 bps",,"__::_..._...___[]:_:____(_-.-.-)__,____",warn,"/app/syslog/10.164.93.7/10.164.93.7.log","syslog_vrsn","splunk6",,16,7

The query I'm using is:

index=syslog_data bandwidth | extract pairdelim="bandwidth", kvdelim="bps", auto=f

does not extract the bandwidth number, in the above example, I just want to extract the number 81659056

I can user the IFX to extract the field, but then the extracted field looks like:

    1   0.877193

5 RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path (lsp R6.NYC.LAX3-1) bandwidth changed, path bandwidth 75085360 bps

What is the best way to extract just the bandwidth from the entry?

Thanks in advance.

Tags (1)
1 Solution

chris
Motivator

Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need:

index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps"

Chris

View solution in original post

chris
Motivator

Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need:

index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps"

Chris

chris
Motivator

You're welcome

0 Karma

DTERM
Contributor

Perfect, gotta learn SPLUNK regex! Thanks!

0 Karma

sdaniels
Splunk Employee
Splunk Employee

As long as you have the line breaking correct for the events in Splunk than a regex like this

(?<=bandwidth\s)\d+(?=\s)

to replace what IFX is coming up with should work. Just go into the config file and change it directly or if you've already deleted it, replace it in the IFX when you create the extraction.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...