topic Re: How to extract part of a field which has hyphens? in Dashboards & Visualizations

How to extract part of a field which has hyphens?

SGL — Wed, 21 Dec 2022 14:46:34 GMT

Hi,

I wanted to extract the field "login-first" and "delaccount" from result events. Following are 2 sample fields from the results logs.

cf_app_name: AB123-login-first-pr

cf_app_name: CD123-delaccount-pr

Sample query used :

index=preprod source=logmon env="preprod"

Please help me to extract the fields.

Thanks in advance,

SGL

gcusello — Wed, 21 Dec 2022 08:34:26 GMT

to help you in field extraction is mandatory to have some sample of your logs to create a regex.

Ciao.

Giuseppe

Manasa_401 — Thu, 22 Dec 2022 09:08:47 GMT

Hello @SGL

I hope the following regex helps you.

| rex field=cf_app_name "(?<new_field>(?<=-).*?(?=-pr))"

If this helps, an upvote would be appreciated.

Thanks,

Manasa

gcusello — Fri, 23 Dec 2022 07:53:32 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉