Splunk Search

extract string from _raw data

owie6466
Explorer

Hello need help to extract the number from this result:

Total number of files under /wmq/logs/AMXDEVRC120/active is: 184

i'm trying to get the total number of files from this directory and compare if over 500. 

 

thank you, 

 

Labels (1)

owie6466
Explorer

thanks for the help

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use rex.

... | rex "is: (?<numFiles>\d+)"
| stats sum(numFiles) as TotalFiles
| where TotalFiles > 500
---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...