rex - extract 2 single values from set of numbers

[splunkuseradmin]

hello guyz,

new to splunk was to figure out solution for this.
I have logs like below need to do " rex" and extract 2 values (1st and 4th) from each log with set like [23,23.000,89.375,35,0], [1,1.000,16.000,4,0] etc.
ex.,
value1- "23" and save in new field with name conferences from every log
value4- "35" and save in new field with name calls from every log
thanks

[vnravikumar]

Hi

Try this

| makeresults 
| eval msg="server: [USAGE] : {\"2\" : [23,23.000,89.375,35,0]}
host = us-voice-vmr11.corp.com" 
| append 
    [| makeresults 
    | eval msg="server: [USAGE] : {\"2\" : [1,1.000,16.000,4,0]}
host = gs-voice-vmr12.corp.com"] 
| rex field=msg "^server:\s\[\w+\]\s:\s\{\"\d+\"\s:\s\[(?P<temp>.+)\]}" 
| eval values = split(temp,",") 
| eval conferences = mvindex(values,0) 
| eval calls = mvindex(values,3)

[memarshall63 · Accepted solution]

I modified the regex above a little to get the correct fields.

^server:\s\[\w+\]\s:\s{\"\d+\"\s\:\s\[(?P<conferences>\d+),\d+.\d+[^,],\d+.\d+,(?P<calls>\d+),\d+\]\}

If you're new to regex, here's a great website to help. You can use it to try regex expressions and collaborate with others to help you become an expert.

https://regex101.com/r/DAog06/1/

[deepashri_123]

Hey @splunkuseradmin ,

Try using this regex:

rex field=_raw "^server:\s\[\w+\]\s:\s{\"\d+\"\s\:\s\[\d+,(?P<conferences>\d+.\d+[^,]),\d+.\d+,(?P<calls>\d+),\d+\]\}"

Let me know if this helps!!