Splunk Search

extract values

Abha
Explorer

I need to extract the following as different values for revenue.
Revenue 374256 318747 271437 271957
Was thinking of using rex command, but cant really work it out. Some help please..

Tags (1)
0 Karma

jpass
Contributor

I'm not good with regular expressions yet but here's how I would do it:

let's say your field is called 'revenue' and it's exactly the string you posted. Revenue 374256 318747 271437 271957

| REX field="revenue" "Revenue (?.*)" | eval rev=split(rev," ") | table revenue,rev

  1. the REX command creates a field called 'rev' which simply remvoves the string "Revenue" from your original value
  2. The SPLIT function creates a multivalue field by breaking the value 'rev' on each space in the string

If you wanted to break your values into separate events you could add:

<your_search> | REX field="revenue" "Revenue (?<rev>.*)" | eval rev=split(rev," ") | mvexpand rev | table revenue,rev

I admit I am still developing my understanding of regular expressions. You will likely find a way to use the single REX command along with REX's max_match="0" attribute to create a multivalue field from the REX generated value.

0 Karma

somesoni2
Revered Legend

Try following

<your base search> | rex field=yourfield "Revenue (?P<Revenue>.+)" | eval Revenue=split(Revenue," ") | mvexpand Revenue
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...