topic Re: How to extract a string that starts with certain words or letters? in Splunk Search

How to extract a string that starts with certain words or letters?

harry521 — Fri, 17 Mar 2017 18:09:40 GMT

I'd like to use rex to extract the event string that starts with certain words or letters, possibly ends with certain words or letters. For example I have a event string like "blah blah blah Start blah blah blah End".

I can do something like:

mySearch|rex field=_raw "Start(?<"myField">.*)End"

I want my result not only "myField" but also including "Start" and "End". How can I do it?

Re: How to extract a string that starts with certain words or letters?

richgalloway — Fri, 17 Mar 2017 18:53:46 GMT

mySearch|rex field=_raw "(?<"myField">Start.*End)"

Re: How to extract a string that starts with certain words or letters?

ddrillic — Fri, 17 Mar 2017 18:54:07 GMT

Something in the spirit of -

| eval _raw="Start 999 End"
| rex field=_raw "(?<aaa>Start \d* End)"

Re: How to extract a string that starts with certain words or letters?

DalJeanis — Fri, 17 Mar 2017 19:09:39 GMT

you just move the parenthesis to be around whatever you want to capture.

Then you can go over to regex101.com and test to make sure you got it right. (Over there, you leave off the quotes and occasionally some character-escaping you had to do in splunk.)

Re: How to extract a string that starts with certain words or letters?

harry521 — Fri, 17 Mar 2017 19:54:20 GMT

I guess I didn't make myself clear. The end result I'd like to show is "Start <"myField"> End" from the original one. I end up with a "dirty" way to implement it as using "eval result=Start.<"myField">.End" to concatenate the strings after extracting myField.

Another way to explain what I want to achieve is to get rid of anything before "Start", and after "End".

Re: How to extract a string that starts with certain words or letters?

woodcock — Sun, 19 Mar 2017 03:47:50 GMT

Is this a trick question?

 mySearch | rex field=_raw "(?<myField>Start.*End)"