Splunk Search

How do I use rex command here?

harshal94
Engager

sample event:

fullFormattedMessage: Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds.

Required field is in bold.

0 Karma
1 Solution

poete
Builder

Hi,

try this

|  makeresults |  eval str="Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds"
|  rex field=str "microseconds to (?<value>\d+) microseconds"

View solution in original post

poete
Builder

Hi,

try this

|  makeresults |  eval str="Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds"
|  rex field=str "microseconds to (?<value>\d+) microseconds"

renjith_nair
SplunkTrust
SplunkTrust

Hi @harshal94 ,

If the format of the string going to be same, then you can use split also (much easier)

|stats count|eval xyz="fullFormattedMessage: Device naa.60000970000297500017533030313231 performance has improved. I/O latency reduced from 3746 microseconds to 1859 microseconds."|eval splitted=split(xyz," ")|eval micsecs=mvindex(splitted,mvcount(splitted)-2)
Happy Splunking!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...