Splunk Search

How to use regex in field extraction?

digital_alchemy
Path Finder

I can't seem to get my regex to work as a field extraction. below is an example string and the regex I'm trying to use.

Sample string:
ab&q=john+schneider+singer+-actor&oq=john+schneider+singer+-actor&g

Regex:
(?<=ab&q=)\S*(?=&oq)

This is what I've been trying in Splunk:
rex field=url "(?<=ab&q=)\S*(?=&oq)(?)"

Basically I want to extract everything between "ab&q=" and "&oq"

Tags (2)
1 Solution

aweitzman
Motivator

I think you're looking for something like this:

rex field=url "ab&q=(?<fieldname>\S*)&oq(.*)"

View solution in original post

aweitzman
Motivator

I think you're looking for something like this:

rex field=url "ab&q=(?<fieldname>\S*)&oq(.*)"

digital_alchemy
Path Finder

Works great thanks.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...