Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- extract a field from csv file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a CSV file, which after indexing looks like this
"data1","12-13",y,20,1,"31.034483"
"data1","12-13",y,20,1,"31.034483"
"data1","12-13",y,20,2,45
"data1","12-13",y,20,3,"31.372549"
"data1","12-13",y,20,4,20
I have written a rex command to get the last column values in a table, but not able see all the variables, as some of it is in ""(double quotes) and some not as well some has decimal points.
My rex command is:-
sourcetype=xyz|search data1|rex "(?i)^(?:[^,]*,){5}(?P<FIELDNAME>.+)"|table FIELDNAME
I want the table to be without double quotes ,as shown below:-
31.034483
31.034483
45
31.372549
20
Please Help...!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to match the last field the best approach imho is to anchor your match against the end of the line, not against how many fields are before the last one. This regex should work:
"?([\d.]+)"?$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to match the last field the best approach imho is to anchor your match against the end of the line, not against how many fields are before the last one. This regex should work:
"?([\d.]+)"?$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Superb..!!!It worked!!
Thanks Ayn...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
... | rex "\"?(?<myvalue>[\d.]+)\"?$" | table myvalue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ayn,
Can you please tell me how to put this regex, as I am new to it. Its very hard for me to understand.
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
