Splunk Search

How to Extract exact result from rex command?

karthi2809
Builder

rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4

 

expected result

41.4

 

Labels (2)
0 Karma

karthi2809
Builder

Thanks

i have to extract only 500 ?
Server returned HTTP response code: 500 for

My regex: rex field=_raw "Server returned HTTP response code:\s(?.+)"

i have to trim only 500

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="| va1eb01 | PROD | Provider86 | 2017-06-14 18:03:19,726 | ERROR | http--10.100.108.44-8080-116 | com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:252) | IOException, geocodeUrl=**http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT+APACHE+RD+STE+100%2CLAS+VEGAS%2CNV+89148-5622%2CUSA&signature=o3Jsz1z-qNPB35WGdVY-bPFrMc8=: java.io.IOException: Server returned HTTP response code: 500 for URL: http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT... at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626) at com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:229) ... 46 lines omitted ..."

| rename COMMENT AS "Everything above generates sample event data; everything below is your soluition"

| rex "^(?:[^\|]*\|){1}(?<field1>[^\|]*)\|(?:[^\|]*\|){1}(?<field2>[^\|]*)\|"

gcusello
SplunkTrust
SplunkTrust

Hi karthi2809,
try this regex (please confirm that at the start of a row there are two pipes |):

\|\|\s+(?<field1>[^ ]*)\s+\|\s+[^ ]*\s+\|\s+(?<field2>[^ ]*)

You can test it at https://regex101.com/r/bVp3gz/1
Bye.
Giuseppe

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...