Splunk Search

Can you help me with my regex expression?

pench2k19
Explorer

Hi Team,

I'm struggling to get the regex expression for the following values. I want to capture the text before the first _ symbol into one field and after the _symbol value into another field. I need a common expression that works for all.

broadridge_endur_exch_trades_parent
1end_endur_exch_trades_parent
1end_endur_comp_trades_parent
1img_img_gl_000
1img_gl
1gmi_GNACMFF1
1lst_agr_trd
epx_epx_afs_file
fxcal_balance_report

I am using the following expression, but it's not working

rex field=Datafeed_name "^(?\w{3,10})_(?\w+)$"

Can you please help?

@vnravikumar @jakt54

0 Karma
1 Solution

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

View solution in original post

0 Karma

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

0 Karma

pench2k19
Explorer

thanks for the quick turn around mate...will check and confirm

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...