topic Re: Regex help! in Splunk Search

Regex help!

sumanssah — Thu, 29 Jun 2017 21:04:46 GMT

Hello All,

Need assistance in regex creation.

I want to remove every thing before an character.

Example:

/REGISTRY/MACHINE/Software/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/{B4F3A835-0E21-4959-BA22-42B3008E02FF}

Want to remove every thing before "{"

And expecting the result as
{B4F3A835-0E21-4959-BA22-42B3008E02FF}

Thanks in advance.

Regards
..............SS

somesoni2 — Thu, 29 Jun 2017 21:11:45 GMT

In line in search you can do like this

your current search which include the fieldInFocus
| rex field=fieldInFocus mode=sed "s/^([^\{]+)(.+)/\2/g"

your current search which include the fieldInFocus
| eval fieldInFocus=replace(fieldInFocus,"([^\{]+)","")

sumanssah — Thu, 29 Jun 2017 21:40:53 GMT

Thanks Soni ,

| rex field=fieldInFocus mode=sed "s/^([^{]+)(.+)/\2/g"

Work as expected 🙂