topic regex for extracting word after symbol in Splunk Search

regex for extracting word after symbol

deeptha1992 — Fri, 31 May 2019 11:54:57 GMT

please help me to extract the quoted word
abcd > efgh > "lmn pqr"

I tried with “(?[^>]$)" but while querying like this
|rex field=_raw “word (?[^>]$)" showing error.

Thanks in advance

Re: regex for extracting word after symbol

DavidHourani — Fri, 31 May 2019 12:03:43 GMT

Hi @deeptha1992,

Try this :

|rex field=_raw “([^>]+[>])+\s?\"(?<YourFieldName>.+)\"$"

Cheers,
David

Re: regex for extracting word after symbol

mydog8it — Fri, 31 May 2019 12:52:21 GMT

I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex:

without a named field--->       |rex field=_raw "\"(.+[^>])\"$"
with a named field --->         |rex field=_raw "\"(?<FieldName>.+[^>])\"$"