Getting Data In

Parsing text

mfrederickson
New Member

I apologize in advance if this question has already been asked and answered. If it has, I am most likely demonstrating my lack of experience in not knowing what to properly search for. I am relatively new to regex. Here is my problem:

I have several records in my file that contain a three digit number (233, 252, 245, etc.) In the lines I am concerned about, they always appear between the ampersand:

& 232 &

& 252 &

So it's ampersand, space, three digit number, space and then ampersand.

How can I extract just the number from the string? I can't seem to find what I am looking for - I really do better with actual examples.....

Any assistance would be appreciated.....even if it's pointing me to documentation somewhere (I know RTFM...)

Thanks

Tags (1)
0 Karma

mfrederickson
New Member

Thanks Vince - I'll give that a shot. I knew it couldn't be that complicated - just having a major brain fart...

0 Karma

vincesesto
Communicator

Hey mfrederckson,

This should be pretty straight forward with a regex such as the following:
&\s(?P[^ ]+)\s&

If you could provide some more information on the actual logs you are searching through, as well as the context of your regex, eg; is it for a props.conf or a search, etc...I would be happy to assist further.

Regards Vince

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...