Splunk Search

How to Extract exact result from rex command?

karthi2809
Builder

rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4

 

expected result

41.4

 

Labels (2)
0 Karma

karthi2809
Builder

Thanks

i have to extract only 500 ?
Server returned HTTP response code: 500 for

My regex: rex field=_raw "Server returned HTTP response code:\s(?.+)"

i have to trim only 500

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="| va1eb01 | PROD | Provider86 | 2017-06-14 18:03:19,726 | ERROR | http--10.100.108.44-8080-116 | com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:252) | IOException, geocodeUrl=**http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT+APACHE+RD+STE+100%2CLAS+VEGAS%2CNV+89148-5622%2CUSA&signature=o3Jsz1z-qNPB35WGdVY-bPFrMc8=: java.io.IOException: Server returned HTTP response code: 500 for URL: http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT... at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626) at com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:229) ... 46 lines omitted ..."

| rename COMMENT AS "Everything above generates sample event data; everything below is your soluition"

| rex "^(?:[^\|]*\|){1}(?<field1>[^\|]*)\|(?:[^\|]*\|){1}(?<field2>[^\|]*)\|"

gcusello
SplunkTrust
SplunkTrust

Hi karthi2809,
try this regex (please confirm that at the start of a row there are two pipes |):

\|\|\s+(?<field1>[^ ]*)\s+\|\s+[^ ]*\s+\|\s+(?<field2>[^ ]*)

You can test it at https://regex101.com/r/bVp3gz/1
Bye.
Giuseppe

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...