topic Re: Regex to capture specific format data in Splunk Enterprise

Regex to capture specific format data

Ashwini008 — Tue, 23 Mar 2021 17:27:45 GMT

Hi,

Please help me with regex to capture only highlighted data

richgalloway — Tue, 23 Mar 2021 18:04:47 GMT

As it turns out, regex does not have the ability to match on highlighting and it's unlikely the data will have highlighting. 🙂

Can you describe how the desired data should be matched?

scelikok — Tue, 23 Mar 2021 19:15:25 GMT

Please try below rex command;

| rex "\w\+\w\.(in_)?(?<data>(?:\w{2,}(?:\.)){1,}\w{3})"

Ashwini008 — Wed, 24 Mar 2021 03:58:31 GMT

@scelikok Can you please explain me the regex expression on how it is capturing only the highlighted data?btw the regex is working fine Thank you!

| rex "\w\+\w\.(in_)?(?<data>(?:\w{2,}(?:\.)){1,}\w{3})"

Hi @richgalloway I highlighted the data to indicate on what data to capture from each of the given example.

scelikok — Wed, 24 Mar 2021 04:41:43 GMT

Great to hear it is working. Let me try to explain.

\w\+\w\.(in_)?(?<data>(?:\w{2,}(?:\.)){1,}\w{3})

\w\+\w\.(in_)? --> Skips first letter+letter pattern and _in (if any)

Start Capturing

(?:\w{2,}(?:\.)){1,} --> Finds pattern that has a word with 2 or more chars and a dot. Find this pattern 1 or more times.

\w{3} --> A word with 3 chars.

End Capture