Splunk Search

how to get extract field in a numeric format?

gwtm_hak
Engager

I'm trying to extract value from a field in the raw text using a regular expression. I want the field values to be extracted in numeric format, but when I field extraction the value is in a string.

{"values":[17.4991095961511,17.4991095961511],"dstypes":["derive","derive"],"dsnames":["io_time","weighted_io_time"],"time":1565729243.743,"interval":2,"host":"node1-zanzibar","plugin":"disk","plugin_instance":"sda","type":"disk_io_time","type_instance":""}

I used the below expression,

^\{"(?P<values>\w+)

which captures the values field but not the values relative to that field.
So I tried with adding d+

^\{"(?P<values>\d+)

There was no result. can anyone help me solve this?

0 Karma
1 Solution

nareshinsvu
Builder

Can you try this?

|makeresults 
|eval _raw=" {\"values\":[17.4991095961511,17.4991095961511],\"dstypes\":[\"derive\",\"derive\"],\"dsnames\":[\"io_time\",\"weighted_io_time\"],\"time\":1565729243.743,\"interval\":2,\"host\":\"node1-zanzibar\",\"plugin\":\"disk\",\"plugin_instance\":\"sda\",\"type\":\"disk_io_time\",\"type_instance\":\"\"} " 

 | rex field=_raw "\{\"values\"\:\[(?<values>.*?)\s*\]\," max_match=0 
 | makemv delim="," values  
 | mvexpand values
 | table values

View solution in original post

nareshinsvu
Builder

Can you try this?

|makeresults 
|eval _raw=" {\"values\":[17.4991095961511,17.4991095961511],\"dstypes\":[\"derive\",\"derive\"],\"dsnames\":[\"io_time\",\"weighted_io_time\"],\"time\":1565729243.743,\"interval\":2,\"host\":\"node1-zanzibar\",\"plugin\":\"disk\",\"plugin_instance\":\"sda\",\"type\":\"disk_io_time\",\"type_instance\":\"\"} " 

 | rex field=_raw "\{\"values\"\:\[(?<values>.*?)\s*\]\," max_match=0 
 | makemv delim="," values  
 | mvexpand values
 | table values
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...