topic Re: Need regex to extract specific data in Splunk Search

Need regex to extract specific data

ninadbhaskarwar — Thu, 22 Jun 2017 18:52:17 GMT

I need a regex to get the output as below -

Input
/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017
/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017

Output
ABCD failure

Xyjw not working

Re: Need regex to extract specific data

somesoni2 — Thu, 22 Jun 2017 19:03:22 GMT

Try like this (run anywhere sample, replace first 2 line with your search, and update the field names per yours)

| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp 
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>[^\:]+)"

Updated Answer

| gentimes start=-1 | eval temp="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017##/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017" | table temp | makemv temp delim="##" | mvexpand temp 
| eval temp=urldecode(temp) | rex field=temp "Alert\s*-\s*(?<YourField>.+)\sDate\:"

Re: Need regex to extract specific data

woodcock — Thu, 22 Jun 2017 19:07:04 GMT

Like this:

|makeresults |eval raw="/ABCD/Safe+Alert+-+ABCD+failure Date: Jun 01,2017
/ABCD / Safe +Alert+-+Xyjw%28s%29+not+working Date: Jun 21,2017"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval output=_raw
| rex field=output mode=sed "s%^/([^/]+)/(?:[^+]*\+){4}(.*) Date.*$%\1 \2% s/\+/ /g"

Re: Need regex to extract specific data

ninadbhaskarwar — Thu, 22 Jun 2017 22:32:25 GMT

Output is "ABCD failure Date", I need output without "Date", any suggestion?

Re: Need regex to extract specific data

woodcock — Fri, 23 Jun 2017 08:29:27 GMT

Try my answer.

Re: Need regex to extract specific data

ninadbhaskarwar — Fri, 23 Jun 2017 15:51:29 GMT

Hi I have already tried your solution but output for second line is

"ABCD not working" where as I was expecting "Xyjw not working"

Re: Need regex to extract specific data

somesoni2 — Fri, 23 Jun 2017 16:07:25 GMT

Try the updated answer.

Re: Need regex to extract specific data

woodcock — Fri, 23 Jun 2017 16:12:05 GMT

Try the updated answer by @somesoni2 😆

Re: Need regex to extract specific data

woodcock — Fri, 23 Jun 2017 16:17:21 GMT

ARGH! I grabbed the wrong ABCD! I will update; hang on...