Splunk Search

How to write the regex to extract this field?

splunker9999
Path Finder

Hi ,

Can someone please suggest the regex for this field extraction?

We need to extract de from below context with field as Name:

csc-3.0.1/r1_de_ *:1012

Thanks

0 Karma

gabriel_vasseur
Contributor

It would help if you could provide many examples of the data, so that we can understand what's variable and what's always the same, as that is key to design a good regex.

sundareshr
Legend

Try this

.. | rex "_(?<Name>\w+)_" | ...

*OR*

.. | rex "_(?<Name>\w{2})_" | ...
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Hey @splunker9999 This will work. The way I learned it was by going to regex101.com and pasting the text and writing regex to make it work

(?<=r1\_)de

splunker9999
Path Finder

Hi , This doesn't works.

I used below
^[^/\n]*/\w+\d+_(?P[a-z]+)

Thanks

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I forgot to mention that the point of regular expressions is to match patterns so if you had any other text than "r1_de" then it will not pick it up. Instead the regex should look like the one below, where it will pick up on digits and letters rather than hardcoded values

(?<=\w\_)\w{2}

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...