Getting Data In

Field Extraction

gjohnson
New Member

I am trying to extract a field from the following lines but the field extraction does not result in a Field. The sample data is a CSV download from a credit card site:

02/14/2013 Thu,,"PIZZA HUT # 023603 0MC LEAN VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,28.75,,,,,,,
02/15/2013 Fri,,"BONSAI GRILL 1234560ARLINGTON VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,32.21,,,,,,,
02/15/2013 Fri,,"EXXONMOBIL MCLEAN VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,57.28,,,,,,,

The field I am looking for has the values of "28.75, 32.21, 57.28" values. I did an automated field extract by copying out the value, putting it in the sample and generating a regex - it successfully identifies the information I want (it is highlighted). I hit save then go back to searching, but the field doesn't extract.

I then tried copying the rex pattern that successfully identified the fields in the auto-generator (see the rex below) and I ran it right on the search bar - but it brought back a sparse return (there wasn't a price field for every line like there should be).

running this yields inconsistent results
... | rex "(?i)^(?:[^\-]*\-){3}\d+\",,,(?P[^,]+)"

Can anyone help me with the right regex for a field extraction that yields a "price" for every line in the file?

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Could you please try below rex.

"(?i)^(?:[^,]*,){7}(?P[^,]+)"

0 Karma

bizza
Path Finder

Hi gjohnson,
why you are not putting that csv in inputs.conf, defining a TRANSFORM in props.conf, defining a field DELIM on your transforms.conf and the assign the right field to the different column?

ciao

bizza
Path Finder

something like this

inputs.conf

[monitor:///path/to/file.csv]
sourcetype = yoursourcetype
disabled = 0

props.conf

[sourcetype::yoursourcetype]
CHECK__FOR _HEADER=TRUE
SHOULD _LINEMERGE = false
TRANSFORM-transformfile = transf_csv

transforms.conf

[transf_csv]
DELIMS=","
FIELDS="field1", "field2", "field3", "field4", "fieldN"

0 Karma

gjohnson
New Member

Sorry, I am not sure I know what you are saying. I did put the CSV in as a file input. I thought that the Field Extraction process would create a delimeter? Am I wrong?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...