Splunk Search

Extract field with regex issue

j3r0n
Explorer

I'm trying to only extract the value of 'value' with regex.

2020-03-04 12:14:26,363 - measurement:34- sensor=43, value="0.034051", date="None"

I've tried this but it didn't work:

| rex field=value "(?<myValue>\d{3})" | search myValue=*

Where did it go wrong and how do I solve this?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

rex is not needed to extract that value. Splunk automatically extracts data in field=value format so you should already have a field called "value" with a value of "0.034051".

If, for some reason, you still want/need to use rex, then the regex string you've used is expecting the value be exactly 3 digits ('\d{3}'), which is not the case with the example event. Try \d+\.\d+.

---
If this reply helps you, Karma would be appreciated.

vnravikumar
Champion

Hi

Check this rex

value="(?P<value>[^"]+)
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...