topic Re: need regex that extracts everything up to a specific character in Splunk Enterprise

What regex can extract everything up to a specific character?

Steve_A200 — Wed, 03 May 2023 13:50:39 GMT

Hi,

I need assistance with writing a regex that extracts all characters upto the character "_" underscore.

so, the data could look like this:

field1:

ABCD_1234234
EFG_12349879
HIJK_12349850

And I would like to only see:

ABCD
EFG
HIJK

I tired this however it is not doing the trick:

| regex field1 = "^.*?(?=\_)"

regex101 seems to show it working but ... I must be missing something when converting it into splunk.

Any help would be appreciated.

Thanks,

abi2023 — Tue, 02 May 2023 22:08:58 GMT

basesearch | rex field=field1 "^(?<field2>[^_]+)_"

Steve_A200 — Wed, 03 May 2023 19:47:21 GMT

Thank you, that worked exactly how I needed it to work.