Splunk Search

help to extract value from field with rex function

ivana27
Path Finder

Hi,

please help. I would like to see in table (to extract with rex) value of field paid. Log is:

2020-12-23 12:14:42.744 [Error] ## Get Sap NOK --> Check:OK (type:aaaa, paid:111.00EUR, change:0.00EUR, changeDddd:0.00EUR) - fffff:OK - rrrrr:NOT_STARTED - bbbb:NOT_STARTED - bnbn: - sn: - gggg:3333 - rererere:54554545- ererr:2

Thank you very much

Iv

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @ivana27,

You can use one of below;

Extracts 111.00EUR
| rex field=_raw "paid:(?<paid>[^,]+)"

Extracts 111.00
| rex field=_raw "paid:(?<paid>[0-9\.]+)"

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @ivana27,

You can use one of below;

Extracts 111.00EUR
| rex field=_raw "paid:(?<paid>[^,]+)"

Extracts 111.00
| rex field=_raw "paid:(?<paid>[0-9\.]+)"

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...