topic What rex command extracts data from csv? in Splunk Enterprise

What rex command extracts data from csv?

Ashwini008 — Fri, 24 Mar 2023 16:29:45 GMT

Hi,

I am trying to extract data from one of the column in lookup file. Regex expression is working in rex tool. I want to use that regex expression in rex command in splunk .

Rexgex expression ^.*(?= \[)

Example: Want to extract the highlighted bold data. This data is present in csv lookup file.

TAX PLATFORM [12998]
CPOI [0639]

| inputlookup Meta.csv | rex field=Application "^.*(?<name>= \[)"

Re: Rex command to extract data from csv

ITWhisperer — Fri, 24 Mar 2023 09:22:19 GMT

| inputlookup Meta.csv | rex field=Application "^(?<name>.*)= \["

Re: Rex command to extract data from csv

Ashwini008 — Fri, 24 Mar 2023 10:42:06 GMT

@ITWhisperer It isn't working

Re: Rex command to extract data from csv

ITWhisperer — Fri, 24 Mar 2023 10:51:22 GMT

Sorry, I left the '=' in unnecessarily - try this

| inputlookup Meta.csv | rex field=Application "^(?<name>.*) \["