Splunk Search

Regex to split field, optional second field

pgreer_splunk
Splunk Employee
Splunk Employee

I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'

For example:

field1
field1:field2
field1
...

I've tried

(?<myfield1>.*):(?<myfield2>.*)

but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

View solution in original post

0 Karma

gokadroid
Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

That seems to have done it.

So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".

That seems to have done it for me. Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...