Splunk Search

How do I extract numerical value from within a string using rex command?

andrewtrobec
Motivator

Hello,

I've been reading up on the rex command and using it to split strings, but I cannot for the life of me get it working. I have the following input:

FORECAST
Sun and a few passing clouds. High 13C. Winds light and variable.
Partly cloudy. Low 4C. Winds light and variable.
Overcast with rain showers at times. High around 10C. Winds NE at 10 to 15 km/h. Chance of rain 60%.
Cloudy skies. Low 2C. Winds ENE at 10 to 15 km/h.
Partly cloudy skies. High 6C. Winds light and variable.
A mostly clear sky. Low -1C. Winds light and variable.
A mainly sunny sky. High 6C. Winds light and variable.
A mostly clear sky. Low near 0C. Winds light and variable.

and my goal is to extract the temperature value into a new field FORECAST_C. I basically have to remove everything up until the space between the date, and everything after starting with "C.". My desired output is:

FORECAST_C
13
4
10
2
6
-1
6
0

I've come up with

rex field=entry ".\s(<FORECAST_C>.*)C\w."

but it's clearly not working...

Can somebody give me a hand?

Thanks!

Andrew

0 Karma
1 Solution

gokadroid
Motivator

If every line is an event try this:

your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If more than one lines are in per event try max_match=0 in it:

your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If the data in question is in field=entry then you can use that field as well in the above commands rather than field=_raw.

See extraction here.

View solution in original post

gokadroid
Motivator

If every line is an event try this:

your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If more than one lines are in per event try max_match=0 in it:

your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C

If the data in question is in field=entry then you can use that field as well in the above commands rather than field=_raw.

See extraction here.

andrewtrobec
Motivator

Exactly that! I saw that you revised your answer since I was about to say that I added the \s so that it would take everything after the space, but I see you caught that already!

Thank you!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...