Splunk Search

Extraction using regular expressions

honobe
Explorer

I want to extract a character string using a regular expression.

I am considering extracting the field (message ID) using the rex command, but I can not extract it with regular expressions.

Message ID = '< xxxxxxxx>'

※I want to extract characters between 「'<」 and 「>'」
※There is no space in the actual log.

I want to extract xxxxxxxx and make the field of message ID have the following form.

Message ID = xxxxxxxx

What kind of regular expression can I use to extract xxxxxxxx?

0 Karma
1 Solution

niketn
Legend

Try the following run-anywhere example.

| makeresults 
| eval _raw = "Message ID = '< xxxxxxxx>'"
| rex field=_raw "Message ID = '<(?<MessageID>[^>]+)>'"

You can test the rex with your sample events. Eventually, create a Field Extraction Knowledge Object for the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi honobe,

based on the provided information this regex:

 '<(?<Message_ID>[^>]+)>'

will match everything between '< and >' and use the match in the new field called Message_ID.

This is a really basic example and can be optimised but I hope it helps to get you started ...

btw don't use field names with spaces 😉

cheers, MuS

honobe
Explorer

Thank you very much.
Thanks to your answer, I was able to solve the problem.

0 Karma

niketn
Legend

Try the following run-anywhere example.

| makeresults 
| eval _raw = "Message ID = '< xxxxxxxx>'"
| rex field=_raw "Message ID = '<(?<MessageID>[^>]+)>'"

You can test the rex with your sample events. Eventually, create a Field Extraction Knowledge Object for the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

honobe
Explorer

Thank you very much.
Thanks to your answer, I was able to solve the problem.

0 Karma

MuS
SplunkTrust
SplunkTrust

typing too slow...again

Just a little tip: there is actually no need to escape the > inside of the [...] it will also work without the escaping

niketn
Legend

Thanks @Mus, I have corrected. But \ in regular expression also tells match exactly. It works either way, I missed removing it.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...