Splunk Search

How to extract substring from a string

bagarwal
Path Finder

Hi Everyone,
I have a string field that contains similar values as given below:

String = This is the string (generic:ggmail.com)(3245612)
= This is the string (generic:abcdexadsfsdf.cc)(1232143)

I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that.

Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com)

May need to use regex. If someone can help me out, Thanks in advance.

Regards,
Binay

Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi

try with something like this

\(generic:(?<Field>[^\)]*)\)\(

test it at https://regex101.com/r/2VG31q/1
Bye.
Giuseppe

0 Karma

niketn
Legend

You can try the following (this is very generic high leve regular expression which you might need to tweak based on your actual sample data):

| rex field=_raw "\(generic:(?<myField>[^\)].*)\)\("
| table _raw myField

Test out your regular expression on regex101.com with more sample data.
Also it is better if you create Field through Interactive Field Extraction (IFX), so that Splunk creates regular expression automatically based on sample data. Field Extraction Knowledge Object will serve better with re-usability and easy maintenance.

Step by Step documentation link : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bagarwal
Path Finder

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...