Splunk Search

Splunk Query

DTERM
Contributor

I'm trying to extract a single field from a log and perform some statistical calculations using stats.

The log entries I have look like the following:

"Jan 22 16:43:48 10.164.93.7 10.164.93.7 local2 warn rpd[1106]: RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp B.R2.CHI-1) bandwidth changed, path bandwidth 81659056 bps","2013-01-22T11:43:48.000-0500",,16,22,43,january,48,tuesday,2013,local,"nix-all-logs",local2,"log.itgh.net",,"syslog_prod",1,22,"C-NET","10.164.93.7","10.164.93.7","R1.BB-FO.BRN1",Jan,"16:43:48","RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path  (lsp R1.CHI2-1) bandwidth changed, path bandwidth 81659056 bps",,"__::_..._...___[]:_:____(_-.-.-)__,____",warn,"/app/syslog/10.164.93.7/10.164.93.7.log","syslog_vrsn","splunk6",,16,7

The query I'm using is:

index=syslog_data bandwidth | extract pairdelim="bandwidth", kvdelim="bps", auto=f

does not extract the bandwidth number, in the above example, I just want to extract the number 81659056

I can user the IFX to extract the field, but then the extracted field looks like:

    1   0.877193

5 RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path (lsp R6.NYC.LAX3-1) bandwidth changed, path bandwidth 75085360 bps

What is the best way to extract just the bandwidth from the entry?

Thanks in advance.

Tags (1)
1 Solution

chris
Motivator

Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need:

index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps"

Chris

View solution in original post

chris
Motivator

Is there a reason why you are using extract? You could just use rex if the bandwidth is the only field you need:

index=syslog_data bandwidth | rex "bandwidth\s(?<my_bandwidth>\d+)\sbps"

Chris

chris
Motivator

You're welcome

0 Karma

DTERM
Contributor

Perfect, gotta learn SPLUNK regex! Thanks!

0 Karma

sdaniels
Splunk Employee
Splunk Employee

As long as you have the line breaking correct for the events in Splunk than a regex like this

(?<=bandwidth\s)\d+(?=\s)

to replace what IFX is coming up with should work. Just go into the config file and change it directly or if you've already deleted it, replace it in the IFX when you create the extraction.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...