Splunk Search

How to extract value with in brackets

kavyatim
Path Finder

Hi ,
I have data in the following format:
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)
NOT_HOMOLOGATED-(UNKNOWN)
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)
HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)
I would like to extract value with in the brackets i.e extracted values should be:
UNKNOWN
Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6
UNKNOWN
ZTE ZXDSL 831 II V7.5.02_E09_BR1
and so on . . . . .

Can any one help me out in writing regex for this as it is not flexible with substring?

Thanking you in advance.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi kavyatim,

something like

YourFancySearch | rex "\((?<myField>.*)\)" 

should work fine for you.
Here is a link to a page were you can test regex on your data.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi kavyatim,

something like

YourFancySearch | rex "\((?<myField>.*)\)" 

should work fine for you.
Here is a link to a page were you can test regex on your data.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...