Splunk Search

Remove Plus Sign In Regex

IRHM73
Motivator

Hi,

I wonder whether someone may be able to help me please.

I currently have the following raw data:

service=ma&report-name=fred+&report-email=77777777777&report-action=i+earn+as+i+work+31+hours+a+week+and+my+husband+does+not+work+at+all+and+has+no+money+coming+in+&report-error=how+to+work+out+what+we+can+claim&isJavascript=true&referrer=https%3A%2F%2Fwww.uk%2Fapplication%2Fcalculator

What I'd like to is extract the after "action=" up to but excluding "&isJavascript". I would also like to exclude the '+' sign so that the text is one long string.

Using "Regex101", I've put together the following:

action=(?<comments>[^$]+)\&is

But the problem I have is that I cannot remove the '+' signs.

I just wondered whether someone could look at this please and offer some guidance on how I may be able to achieve this.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi, your regex is fine. Simply add another line to replace the + sign:

yoursearch
| rex field=_raw "action=(?<comments>[^$]+)\&is"
| eval comments=replace(comments, "\+", "")

Thanks,
J

View solution in original post

ddrillic
Ultra Champion

eval decode=urldecode(_raw) should convert the + signs to spaces...

ddrillic
Ultra Champion

Chris, keep in mind please that you can use the Field Extractor feature for such cases - most powerful.

0 Karma

IRHM73
Motivator

Hi @ddrillic, thank you for taking the time to reply to my post and for the information. I hadn't realised that.

Kind Regards

Chris

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, your regex is fine. Simply add another line to replace the + sign:

yoursearch
| rex field=_raw "action=(?<comments>[^$]+)\&is"
| eval comments=replace(comments, "\+", "")

Thanks,
J

IRHM73
Motivator

Hi @javiergn, thank you very much, it works great.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...