Splunk Search

extract string from _raw data

owie6466
Explorer

Hello need help to extract the number from this result:

Total number of files under /wmq/logs/AMXDEVRC120/active is: 184

i'm trying to get the total number of files from this directory and compare if over 500. 

 

thank you, 

 

Labels (1)

owie6466
Explorer

thanks for the help

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use rex.

... | rex "is: (?<numFiles>\d+)"
| stats sum(numFiles) as TotalFiles
| where TotalFiles > 500
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...