Splunk Search

How can I Rex to match until a string

mattodo
Explorer

Hi folks,

I'm new to regex and am struggling to extract a number from a field. I basically need the amount extracted from the following;

Date Name Amount Curr Type Status
------------------- -------------------- ---------- ---- ------------ ------
07.05.2016 22:58:09 Person's Name 5.00 GBP Sale Okay

It is the variable length text before the number that I am struggling with.

Please can you suggest a way in which I can extract just the 5.00 in the above example?

Thanks in advance 🙂

Matt

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this but ignoring the top 3 lines that I used to replicate your event.

Option 1 (from your raw event):

| stats count
| fields - count
| eval _raw = "07.05.2016 22:58:09 Person's Name 5.00 GBP Sale Okay"
| rex field=_raw "(?<Amount_num>\d+\.\d{2}) GBP"

Option 2 (assuming there's a field named Amount as indicated above):

| stats count
| fields - count
| eval Amount = "5.00 GBP"
| rex field=Amount "(?<Amount_num>\d+\.\d{2})"

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this but ignoring the top 3 lines that I used to replicate your event.

Option 1 (from your raw event):

| stats count
| fields - count
| eval _raw = "07.05.2016 22:58:09 Person's Name 5.00 GBP Sale Okay"
| rex field=_raw "(?<Amount_num>\d+\.\d{2}) GBP"

Option 2 (assuming there's a field named Amount as indicated above):

| stats count
| fields - count
| eval Amount = "5.00 GBP"
| rex field=Amount "(?<Amount_num>\d+\.\d{2})"

mattodo
Explorer

Many thanks for the prompt reply Javiergn, It shows I am new to this because I copied and pasted from one of my records and the formatting was lost. There are actually many spaces between the field sections. I have now found the code sample feature 😉 so the data should look like this;

Date                Name                     Amount Curr Type         Status
------------------- -------------------- ---------- ---- ------------ ------
07.05.2016 22:58:09 Person's name                 5.00 GBP  Sale         Okay  

The rex you gave did not return anything. Is this due to the extra spaces?

Thanks again!

Matt

0 Karma

mattodo
Explorer

Hi again, your method worked great (minor error on my part) so I have exactly what I need.

Many thanks, you have really helped me out!

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, no worries. Happy to help.

If you are happy with the response please mark it as answered so that others can benefit from it.

0 Karma

mattodo
Explorer

done 🙂 TY

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...