Splunk Search

How to Extract exact result from rex command?

karthi2809
Builder

rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4

 

expected result

41.4

 

Labels (2)
0 Karma

karthi2809
Builder

Thanks

i have to extract only 500 ?
Server returned HTTP response code: 500 for

My regex: rex field=_raw "Server returned HTTP response code:\s(?.+)"

i have to trim only 500

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="| va1eb01 | PROD | Provider86 | 2017-06-14 18:03:19,726 | ERROR | http--10.100.108.44-8080-116 | com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:252) | IOException, geocodeUrl=**http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT+APACHE+RD+STE+100%2CLAS+VEGAS%2CNV+89148-5622%2CUSA&signature=o3Jsz1z-qNPB35WGdVY-bPFrMc8=: java.io.IOException: Server returned HTTP response code: 500 for URL: http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT... at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626) at com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:229) ... 46 lines omitted ..."

| rename COMMENT AS "Everything above generates sample event data; everything below is your soluition"

| rex "^(?:[^\|]*\|){1}(?<field1>[^\|]*)\|(?:[^\|]*\|){1}(?<field2>[^\|]*)\|"

gcusello
SplunkTrust
SplunkTrust

Hi karthi2809,
try this regex (please confirm that at the start of a row there are two pipes |):

\|\|\s+(?<field1>[^ ]*)\s+\|\s+[^ ]*\s+\|\s+(?<field2>[^ ]*)

You can test it at https://regex101.com/r/bVp3gz/1
Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...