Hello everyone,
I have a simple question about rex, I have not been successful.
I have a string:
"bllablla_toni"
"bloobloo_jony"
And I am want to extract the string after character "_".
The result will be:
"toni"
"jony"
Thanks!
,Is work
Thank!
Hi @eli_da
Try this simple rex
| makeresults
| eval str="bllablla_toni,bloobloo_jony"
| makemv delim="," str
| rex field=str "\_(?P<result>\w+)"
| mvexpand result
| table result
Hi
The following should do the trick:
[^_]+\_(?<extracted_string>.*)
Applied to rex (just copy and paste into splunk directly):
| makeresults
| eval events="bllablla_toni bloobloo_jony"
| eval events=split(events, " ")
| mvexpand events
| rename events as strings
| rename COMMENT AS "--- Sample Generated Events Above ---"
| rex field=strings "[^\_]+\_(?<extracted_string>.*)"
Hope it helps