Splunk Search

Extract field with regex issue

j3r0n
Explorer

I'm trying to only extract the value of 'value' with regex.

2020-03-04 12:14:26,363 - measurement:34- sensor=43, value="0.034051", date="None"

I've tried this but it didn't work:

| rex field=value "(?<myValue>\d{3})" | search myValue=*

Where did it go wrong and how do I solve this?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.

---
If this reply helps you, Karma would be appreciated.

vnravikumar
Champion

Hi

Check this rex

value="(?P<value>[^"]+)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...