topic Regex in Installation

Regex

Khuzair81 — Tue, 10 Aug 2021 18:12:29 GMT

Hi All,

Please help me to solve this.

desc="Trigger App : Search [Abc_[qwert] asd] number"

I want to fetch the "[Abc_[qwert] asd]" from the above string

Thanks

scelikok — Tue, 10 Aug 2021 18:18:31 GMT

Please try below;

| rex field=desc "(?<new_field>\[.+[^\]].*\])"

Khuzair81 — Tue, 10 Aug 2021 18:21:40 GMT

Bigslee — Tue, 10 Aug 2021 20:13:11 GMT

try using https://regex101.com . You can test your regex statements prior to using them on splunk