Splunk Search

How to find all values after a certain label in a field with regex?

Chandras11
Communicator

Hi All,
I have a big text field with sample value as:

Random text Location:AL432   1)ART: New order  ANYTHING  Location:B2332  1)ART: Any order   Random text 

I need to extract all the locations for example AL432 and B2332 and put them together in a new field. Please note that Location and 1)ART will always surround the location Id.

I can use something like:

| rex field=_raw "Location: (?P<LocationID>\d+) \)ART:" | eval LOCATIONVALUES= case(match(TEXT,"Location"), LocationID)

But I am completely sure if my regex syntax is correct here. Also I need to put all Locations in LOCATIONVALUES together.

Thanks in advance

0 Karma
1 Solution

knielsen
Contributor

Well, you can directly grab all matches into the field LOCATIONVALUES, eg:

rex field=_raw max_match=0 "Location:(?<LOCATIONVALUES>\S+)"

# run everywhere:
| makeresults 
| eval input=" Random text Location:AL432   1)ART: New order  ANYTHING  Location:B2332  1)ART: Any order   Random text " 
| rex field=input max_match=0 "Location:(?<LOCATIONVALUES>\S+)"

You can then do what you need with the field, eg use mv commands to for it into something you like.

View solution in original post

knielsen
Contributor

Well, you can directly grab all matches into the field LOCATIONVALUES, eg:

rex field=_raw max_match=0 "Location:(?<LOCATIONVALUES>\S+)"

# run everywhere:
| makeresults 
| eval input=" Random text Location:AL432   1)ART: New order  ANYTHING  Location:B2332  1)ART: Any order   Random text " 
| rex field=input max_match=0 "Location:(?<LOCATIONVALUES>\S+)"

You can then do what you need with the field, eg use mv commands to for it into something you like.

Chandras11
Communicator

Thanks a lot for your help. FInally found the solution.
For me it is:

| rex field=input max_match=0 "^(.*?)Location:(?<LOCATIONVALUES>\s*[^ ]*)" 
and it is working perfectly.
0 Karma

Chandras11
Communicator

Thanks a lot.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi Chandras11,
regex doesn't seem correct, try:

Location:(?<Location>[^ ]*)

you can test at https://regex101.com/r/FEyqTW/1

Bye.
Giuseppe

Chandras11
Communicator

I tried it as : "^(.?)Location:(?\s[^ ]) " which gives me just the first location. I need to extract all locations.
Now its working for all events and ignore the white space after the location keyword (\s
). however, it just finds the first occurrence. Any way to get values together

0 Karma

Chandras11
Communicator

its working now. Need max_match as suggested by @knielsen

0 Karma

Chandras11
Communicator

Thanks a lot. I am checking further in my query 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...