Splunk Search

regex to match everything between the 25th and 130th characters in a line

mritenburg
New Member

Hello,

I am trying to craft a regex to match everything between the 25th and 130th character in a line. I am having no success. Someone suggested ^.{25} (?P<FIELDNAME>.{130} but that doesn't work at all. Does anyone know how to create this regex?

Thank you!

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

View solution in original post

rtadams89
Contributor

Depending on what you are trying to accomplish, you may be better off using the eval substr() function. For example:

... | eval newField=substr(field, 26, 104)

Otherwise, you can use this regex to extract the same thing:

^.{25}(?P<newField>.{0,105})
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

mritenburg
New Member

This works perfectly ^.{25}(?P.{1,105}).

Thank you!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...