Splunk Search

How to pull one variable with multiple changing values?

aohls
Contributor

I have for example something as follows, "Request X|Y|Z" where X, Y, and Z all change each time the message is displayed. In this case I only want to review value Z. I was thinking something like the following:

rex (?<num1>\d)|(?<num2>\d)|(?<num3>\d), but I am not getting he results back as expected. What would be the best way to handle this?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

... | rex "(?<thing1>[^\|]+)|(?<thing2>>[^\|])|(?<thing3>>[^\|])"

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

regex101.com is your friend. You can put an example text value to extract, and your regular expression, into the screen and it will show you what happens.

It's not always perfect in its match with what splunk will do, but in this case it would have taught you that the | needed to be \|.

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "(?<thing1>[^\|]+)|(?<thing2>>[^\|])|(?<thing3>>[^\|])"
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The vertical bars (|) in your events are literal, but when you use them in regex as shown, they become logical ORs. You need to escape such special characters if they are literal.

rex (?<num1>\d)\|(?<num2>\d)\|(?<num3>\d)

In fact if you are only interested in Z, you don't have to extract num1 and num2.

0 Karma

aohls
Contributor

Would I need to add anything to account for blank space?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes, if your data contains blank spaces, you need to account for them.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...