Splunk Search

How do you write rex to extract unstructured field?

haja4nhn
New Member

I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field.

10/1/2017       0:10:01            all        9.13     0          1.68     6.6       0          82.59
10/1/2017       0:20:01            all        7.46     0          0          5.74     0          85.17
10/1/2017       0:30:01            all        9.05     0          129     1.53     0          88.13
10/1/2017       0:40:01            all        7.77     0          1.45     1.23     0          89.54
10/1/2017       0:50:01            all        7.08     0          1.5       1.41     0          90.02
10/1/2017       1:00:01            all        6.46     0          1.43     1.82     0          90.29
10/1/2017       1:10:01            all        45.4     0          4.2       29.27   0          21.13
10/1/2017       1:20:01            all        61.74   0          4.74     31.19   0          2.32
10/1/2017       1:30:01            all        64.17   0          4.72     26.31   0          4.81
10/1/2017       1:40:01            all        47.54   0          4.23     19.44   0          28.79
10/1/2017       1:50:01            all        44.59   0          3.68     17.47   0          34.27
10/1/2017       2:00:01            all        49.16   0          4.22     13.47   0          33.15
10/1/2017       2:10:01            all        41.98   0          3.95     16.47   0          37.59

Thanks.

0 Karma

landen99
Motivator

Anchor on the word "all",
props.conf

[myst]
EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+)

195 steps. https://regex101.com/r/l2PGs6/2

Change myst to your sourcetype and field1 to your field name.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @haja4nhn, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

If you have the option, define your sourcetype for this log source in props.conf and use the FIELD_NAMES / FIELD_DELIMITER to assign the proper field names. Keeps your searches clean... 😉

cpetterborg
SplunkTrust
SplunkTrust

This is probably the most efficient way to do the field extraction:

^(\S+\s+){5}(?P<field6>\S+)

It requires few steps and has the advantage of being able to extract any data, including strings. It does require that the spaces only be between columns of the data (so no fields that have spaces in them). It's also pretty easy to read and modify.

haja4nhn
New Member

@cpetterborg

Thanks for your reply.

Let me check this..

0 Karma

sbbadri
Motivator

@haja4nhn

try this,

you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)"

0 Karma

haja4nhn
New Member

@sbbadri

I have tried this looks like the values are changing. I checking and trying to alter your rex.

Lets see.

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...