Splunk Search

Regex to extract the end of a string (from a field) before a specific character (starting form the right)

mdeterville
Path Finder

Hi Everyone:

I'd like to extract everything before the first "=" below (starting from the right):

sender=john&uid=johndoe

Note: I will be dealing with varying uid's and string lengths.

Any assistance would be greatly appreciated.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

to4kawa
Ultra Champion

Plan A:

| makeresults
| eval _raw="something_time something  test=foobaa&sender=john&uid=johndoe"
| extract pairdelim="&" kvdelim="="
| eval uid_length=len(uid)

It may not be so easy, I tried to extract from _raw.

Plan B:

| makeresults
| eval your_field="foobaa&sender=john&uid=johndoe"
| eval tmp=mvindex(split(your_field,"&"),mvfind(split(your_field,"&"),"uid"))
| eval uid=mvindex(split(tmp,"="),1)
| eval uid_length=len(uid)

All plans are REGEX-free

0 Karma

woodcock
Esteemed Legend

Even more generic, try this:

| rex "(?<last_word>[^=]+$)"

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

mdeterville
Path Finder

This worked, thank you so much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...