Splunk Search

Trouble extracting field using regex

gopx101
New Member

I'm having an issue using regex to extract some _raw data and I hope someone can help me.

The below regex examples works successfully in a regex checker but not in Splunk.

Regex:
^(?:query\/time\",\"value\":)(?P\d+) OR
^(query\/time\",\"value\":)(?P\d+)

Data from Splunk _raw
"query/time\",\"value\":319

In this example I need to place 319 into variable query_time

Thanks in advance to anyone that can provide a regex that will work in Splunk.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

\"query\/time[^\:]+\:(?<YourFieldNameHere>\d+)

View solution in original post

0 Karma

pruthvikrishnap
Contributor

Try this :(.*)$
Let me know if this works

0 Karma

somesoni2
Revered Legend

Give this a try

\"query\/time[^\:]+\:(?<YourFieldNameHere>\d+)
0 Karma

lakromani
Builder

Are you sure you need to escape the : ?
Your suggestion

[^\:]+\:

I think this should work

[^:]+:
0 Karma

gopx101
New Member

This worked perfectly. Thank you.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...