Splunk Search

Is there any way of searching for any character follow by comma using rex

rajivchadha
New Member

Does splunk rex have a concept of doing a .*, in the rex function? I basically want to search for any character followed by a comma.

Tags (2)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Does "any character" include commas too?

If not, you can possibly do it like this:

"[^\,]+\,"

Which reads as 1 or more non-comma characters followed by a comma.

You can then group all of that in a token you want to capture, and problem solved.

| rex "(?<fieldnameFoo>[^\,]+)\,"

Thanks,
J

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

In regex . stands for any character and \, stands for comma.

So

  | rex (?<anyChar>.)\, 

Should work

However if you're not wanting to extract the field and instead you're just searching for it, use the regex command.

   | regex .\,
0 Karma

rajivchadha
New Member

I tried the rex command like below and it did not work as per your suggestion

index="md_dev" ( "Subscribe for") | rex max_match=0 "(?identifier=.*\,)"

also tried

index="md_dev" ( "Subscribe for") | rex max_match=0 "(?identifier=[.]*\,)"

which did not work

0 Karma

javiergn
SplunkTrust
SplunkTrust

Does "any character" include commas too?

If not, you can possibly do it like this:

"[^\,]+\,"

Which reads as 1 or more non-comma characters followed by a comma.

You can then group all of that in a token you want to capture, and problem solved.

| rex "(?<fieldnameFoo>[^\,]+)\,"

Thanks,
J

0 Karma

rajivchadha
New Member

Thanks. I tried what you suggested and it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...