Is there a way to create a transforms for separate values while not breaking current regex instances that are working? Currently, we are capturing data, however one of the tools that creates the reports formats them both with numeric values AND abbreviated values (ie: 2M instead of 2,000,000). I am looking toward creating a transforms in my lookups to assign each 'M' (examples below) value to a numeric value, but not sure this will break my current regex for working numeric metrics. ^(?:[^,\n]*,){5}(?P.+) Again, numeric values are being passed without issue.
example of **possible** transforms
Count, Count
1M,1,000,000
2M,2,000,000
3M,3,000,000
Current Example of metrics coming into Splunk.
**Count**
"514,882"
"258,509"
"514,970"
"541,708"
"96,494"
"110,341"
1.7M
"209,075"
1.5M
"222,845"
1.8M
2M
1.1M
1M
"245,802"
2.4M
1.3M
2.8M
"187,360"
2M
1.5M
1.6M
1.6M
4.8M
1.5M
5M
3M
1.5M
1.7M
"84,007"
↧