- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to use rex to get matching number?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried to use | rex "^Version\s(?P(\\d{2}))$ to extract version number - it should only be 2 digit number.
But 12.1.0.2.0 returned as well and I am not sure if this is a Splunk issue or my SPL issue.
Any help is appreciated here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks guys for your quick help....
I find a way to work around. instead of just get the numbers, I put string content in the rex... it works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks guys for your quick help....
I find a way to work around. instead of just get the numbers, I put string content in the rex... it works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sourcetype=testData
| rex "^Version\s(?P(\d{2}))$"
| chart values(version)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you share some sample data?
Have you tried \d instead of \\d?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for reply, I Just tried \d, same return...
This is the line I would like to capture: "Version 18"
There are lines related to 12.1.0.2.0
Version 12.1.0.2.0 - Production
Not sure why both 18 and 12.1.0.2.0 are returned with that query...
$ seems does not work here either.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What's your full search??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sourcetype=test
| rex "^Version\s(?P(\d{2}))$" | chart values(version)
pretty simple query here....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you add sample raw data for both kind of events?
Is Version to be extracted always within double quotes? As it is in your example "Version 18".
Since regular expressions are patter based if you provide a sample of the two events we can use before and after content to form the right regular expression.
Following is the extraction based on your sample data (however as stated this might not work unless you provide us with some sample events as is. You can mock/anonymize and sensitive information as required)
| makeresults
| eval data="Version 18;Version 12.0.0.2"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex "Version\s(?<version>\d{2})(?!\.)"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Raw Data as follow:
<2018-03-15 11:06:43.958>
Version 18
<2018-03-15 11:06:44.040> Detected Release 12.1.0.2.0
<2018-03-15 11:06:44.049> Detected Release 12.1.0.2.0
Linux: Version 12.1.0.2.0 - Production on 15-MAR-2018 11:06:14
No double quotes 🙂
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
