Regex Help!

[shri_27]

Hi All,

I have a field whose values look like value1>value2>value3!!

Now i want to extract only value3 using rex!

I am not getting how to do that, Please help!

Thanks in advance:-)

[vqd361]

This will get the last value:

rex ">(?<lastvalue>[^>]+?)!!$"

[sbrant_splunk]

Another option (if the 3rd value is always at the end of the record):

(?<value3>[^\>]+)(?=$)

[gfuente]

Hello

Try this

... | rex "((\w|\s)+\>){2}\s(?<value3>(\w|\s)+)" |...

It would be good to have some real examples, to see what pattern should we look for, but this may work.

Regards

EDIT: Updated rex

[Rob]

While that regex works, you might want to try improving it a little so it performs a bit better.

E.g. consider

(\w|\s)+

vs.

[\w\s]+

As you discovered, the hyphen messes things up a little. You may want to try something such as the following:

(?:[^>]+>){2}\s*(?<value3>.+)

If there are any characters after the value3 field, then you may want to use that to anchor the end of the extraction. Something like:

(?:[^>]+>){2}\s*(?<value3>.+)\b

Should help.

If value3 is always at the end of the string, something very simple such as:

.*>\s(?<value3>.+)

Will work very well.

[shri_27]

Got it!! Need to add |- between \w|\s..
Thanks again:-)

[shri_27]

Olympic_foh_Main-Stadium > Main-Stadium Concession > Concession Areas

surprisingly am not able to extract 3rd value for this example!!

[shri_27]

That worked:-) Thanks

[gfuente]

It is because of the white spaces, let me update the regex

[shri_27]

i want to extract only Common Domain Park

[shri_27]

real value above! Not able to extract value3 from both the rex expressions

[shri_27]

System Campus > Common Domain > Common Domain Park

[MuS]

Hi shri_27,

if your data always looks like this one line example and your needed value is always at the last/3rd place like in the one line example, you can use something like this:

... | rex "(.+>){2}(?<myValue>.+)" | ...

this will give you myValue=value3

cheers, MuS