Splunk Search

Extract the second word with the events

prettysunshinez
Explorer

All,

I'm able to extract the second word but now the requirement is little different.

_time _raw
Shivera 346.789.63 is taking the second class 456.789.345,345.67.56
Shivera 345.786.66 now on the track class 56.78.67,-
Madura 456.190.45 shrewed it
aaruliya 455.67.30 top class calls 984.04.62 extra
Ghiya 495.81.22 tracking 627.85.79,34.56.78

Here in one event,there are different no. Of lines of logs.
And as i haved highlighted I would wanted to extract those alone.

How can i achieve it.

Thanks

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @prettysunshinez,
you could try something like this:

^\w+\s+(?<my_field>[^ ]*)

that you can test at https://regex101.com/r/B6ZNn4/1

Ciao and Merry Christmas.
Giuseppe

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="Shivera 346.789.63 is taking the second class 456.789.345,345.67.56#Shivera 345.786.66 now on the track class 56.78.67,-#Madura 456.190.45 shrewed it#aaruliya 455.67.30 top class calls 984.04.62 extra#Ghiya 495.81.22 tracking 627.85.79,34.56.78" 
| makemv delim="#" temp 
| mvexpand temp 
| rex field=temp "^[^\s]+\s+(?P<output>[0-9.]+)"

or

| makeresults 
| eval temp="Shivera 346.789.63 is taking the second class 456.789.345,345.67.56#Shivera 345.786.66 now on the track class 56.78.67,-#Madura 456.190.45 shrewed it#aaruliya 455.67.30 top class calls 984.04.62 extra#Ghiya 495.81.22 tracking 627.85.79,34.56.78" 
| makemv delim="#" temp 
| mvexpand temp 
| eval output =mvindex(split(temp," "),1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...