Splunk Search

How to edit my regular expression to extract numbers before key characters in my sample data?

JoshuaJohn
Contributor

I have this statement:

10.211.1.114    10.222.3.33:4331    -   2016-09-07  14:10:06    0.004   GET /openapi-rest-web/akamai-object.htm -   200 6548    "Java/1.7.0_45" "54.444.444.444"    -   null    [corRID::null]  [KEY::-HTTPMonitor-Loyalty] [UID::-]

I am trying to grab the 0.004

10.200.1.200    10.002.0.98:012 -   2016-09-07  14:40:06    0.39    POST    /openapi-rest-web/v1/kohlsCash  -   200 918 "Apache-HttpClient/4.3.3 (java 1.5)"    "100.100.00.187, 144.41.141.00, 144.41.141.44, 54.009.200.002, 144.41.141.44"   -   null    [corRID::NAID-iOS-98797AB9-2978-4987-90CA-059879789-1473276124.978987]  [KEY::NUNlVg4532432523mLL8MEpqVvxW9]    [UID::-]

I am trying to grab the 0.39

I have this regular expression so far: ^.*(GET|POST)
Which gets me everything before the GET or POST

Any suggestions?

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers

View solution in original post

somesoni2
Revered Legend

This should do it

your base search | rex "^(\S+\s+){5}(?<YourFieldName>\S+)"
0 Karma

sundareshr
Legend

Try this

... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers

JoshuaJohn
Contributor

Doesn't seem to work sorry, only getting blank null entries using that

0 Karma

JoshuaJohn
Contributor
| rex "(?\d+\.\d+)\s(GET|POST)" | where match(response_time,"[a-zA-Z0-9]")| table response_time

This did it

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...