Splunk Search

How can I extract these 3 values from this string via regex?

vinay4444
Explorer

Hi

I need a regex match on the below pattern. I need to capture 3 values from

"ms.db.tablespace_status_ind[DBID_FACT_D03,NORMAL]"

name -> ms.db.tablespace_status_ind
table-> DBID_FACT_D03
status-> NORMAL

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...