Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do you write rex to extract unstructured field?

$
0
0
I have the below log. I want to extract the sixth column as a field, in that column I have different types values. Some of them are decimals some of the are single digit as you can see. I tried IFX it's not working as expected and don't how to write rex for this kind of values, help me to write rex for this field. 10/1/2017 0:10:01 all 9.13 0 1.68 6.6 0 82.59 10/1/2017 0:20:01 all 7.46 0 0 5.74 0 85.17 10/1/2017 0:30:01 all 9.05 0 129 1.53 0 88.13 10/1/2017 0:40:01 all 7.77 0 1.45 1.23 0 89.54 10/1/2017 0:50:01 all 7.08 0 1.5 1.41 0 90.02 10/1/2017 1:00:01 all 6.46 0 1.43 1.82 0 90.29 10/1/2017 1:10:01 all 45.4 0 4.2 29.27 0 21.13 10/1/2017 1:20:01 all 61.74 0 4.74 31.19 0 2.32 10/1/2017 1:30:01 all 64.17 0 4.72 26.31 0 4.81 10/1/2017 1:40:01 all 47.54 0 4.23 19.44 0 28.79 10/1/2017 1:50:01 all 44.59 0 3.68 17.47 0 34.27 10/1/2017 2:00:01 all 49.16 0 4.22 13.47 0 33.15 10/1/2017 2:10:01 all 41.98 0 3.95 16.47 0 37.59 Thanks.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>