topic Re: Rex to Extract Specific Word in Splunk Search

Rex to Extract Specific Word

IRHM73 — Fri, 29 Dec 2017 06:41:37 GMT

Hi, I wonder whether someone maybe able to help me please.

I'm using the following rex to extract the word ID from a text string, which can be written in many permutations, e.g. ID, Id, id.

| rex field=text "/^|[^a-zA-Z](?<a>(?i)id)[^a-zA-Z]|$"

Could someone tell me please, is there a simpler way to write this?

Many thanks and kind regards

Chris

Re: Rex to Extract Specific Word

DalJeanis — Fri, 29 Dec 2017 07:14:58 GMT

This will place any single combination of ( ID, iD, Id, or id) that is found in field text into field a, if that is what you want.

 | rex field=text "(?i)(?<a>id)"

Re: Rex to Extract Specific Word

IRHM73 — Fri, 29 Dec 2017 07:35:34 GMT

Hi, thank you for this @DalJeanis, but unfortunately it doesn't quite work because it extracts the id from words such as "said".

Many thanks and kind regards

Chris

Re: Rex to Extract Specific Word

493669 — Fri, 29 Dec 2017 08:06:54 GMT

 | rex field=text "\s(?i)(?<a>id)\s"

it will match word ID(case insensitive) from a text string

Re: Rex to Extract Specific Word

IRHM73 — Fri, 29 Dec 2017 08:44:33 GMT

Hi @493669, thank you for this.

It certainly extracts the correct words in the different formats, but unfortunately if there is a succeeding special character such a s a . or ) it doesn't extract the word.

Many thanks and kind regards

Chris

Re: Rex to Extract Specific Word

493669 — Fri, 29 Dec 2017 09:59:25 GMT

Can you try below

| rex field=text "\s(?i)(?<a>id)."

Re: Rex to Extract Specific Word

IRHM73 — Fri, 29 Dec 2017 10:16:55 GMT

Hi, thank you for coming back to me with this.

I'm sorry this has a similar issue in that it extracts id from the word "identity".

Many thanks and kind regards

Chris

Re: Rex to Extract Specific Word

niketn — Fri, 29 Dec 2017 10:19:25 GMT

Can you add some sample data?

Re: Rex to Extract Specific Word

IRHM73 — Fri, 29 Dec 2017 10:29:12 GMT

If it helps, here is sample data where id should not be extracted:

The first part of registration was
straight forward but I have been left
confused as to if the process was
completed or not ? when I tried to
continue the system did not recognise
my identity ?

Regards

Chris

Re: Rex to Extract Specific Word

wenthold — Fri, 29 Dec 2017 14:06:31 GMT

Try

| rex field=text "\b(?i)(?<a>id)\b"

Re: Rex to Extract Specific Word

493669 — Fri, 29 Dec 2017 16:48:25 GMT

Thanks for sample data.

 | rex field=text "\b(?i)(?id)\b"

here \b matches any position that lies at boundary of word "id"
(?i) --> case insensitive match

Re: Rex to Extract Specific Word

micahkemp — Fri, 29 Dec 2017 17:01:20 GMT

| rex field=text (?<!\w)(?i)(?<a>id)(?!\w)

That looks for the term id not surrounded by other word characters.

Re: Rex to Extract Specific Word

IRHM73 — Tue, 02 Jan 2018 07:01:54 GMT

Hi @wenthold, this works great, thank you very much for taking the time to put this together.

Many thanks and kind regards

Chris

Re: Rex to Extract Specific Word

IRHM73 — Tue, 02 Jan 2018 07:05:23 GMT

Hi @493669, as per the solution from @wenthold, this works great and thank you for the explanation.

If you change this to an answer I can accept it.

Kind Regards

Chris