topic How to create a regex to extract string1 after the occurrence of string2? in Splunk Search

How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Wed, 27 Jun 2018 18:00:23 GMT

In my logs I have something that looks like the following "string1":"string2" I would like to extract string2 as a field using string1 as a reference point for my regex.

Re: How to create a regex to extract string1 after the occurrence of string2?

jkat54 — Wed, 27 Jun 2018 18:05:45 GMT

Try this:

... your root search ...
| rex ‘string1”:”(?<fieldName>\w+)”’

Note there’s a double quote followed by single quote at the end

Re: How to create a regex to extract string1 after the occurrence of string2?

cpetterborg — Wed, 27 Jun 2018 20:43:35 GMT

To make sure you get any string (except one with an embedded double quote) you should use @jkat54 's answer with a small modification:

... your root search ...
 | rex ‘string1”:”(?<fieldName>[^\"]+)”’

That will allow for spaces, punctuation, etc.

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Wed, 27 Jun 2018 21:07:53 GMT

This does not work splunk is throwing an error. However when I use jkats it doesn't work either but there is no error.

The query I'm using is the following

| rex ‘catalog_name”:”(?\w+)” | top fieldname

where the exact example is: "catalog_name":"firmwide"

i want to save firmwide into the fieldname field.

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Wed, 27 Jun 2018 21:15:36 GMT

For some reason the full regex expression isnt showing up in the comment but Im using what you wrote.

Re: How to create a regex to extract string1 after the occurrence of string2?

cpetterborg — Wed, 27 Jun 2018 21:16:39 GMT

Sorry. Here is an example "run-anywhere" search that I checked on my system:

| makeresults
| eval data="\"catalog_name\":\"firmwide\""
| rex field=data "\"catalog_name\":\"(?<catalog_name>[^\"]+)"

See if this one works for you.

Re: How to create a regex to extract string1 after the occurrence of string2?

jkat54 — Wed, 27 Jun 2018 21:51:41 GMT

Looks like you missed the single quote on the end of the regex.

I also don’t see the <fieldName> after the ? But I think the forum stripped that because you didn’t use the 101010 button to post code.

I see no reason why this wouldn’t work.

Re: How to create a regex to extract string1 after the occurrence of string2?

jkat54 — Wed, 27 Jun 2018 21:53:27 GMT

Unless you used fieldName in the regex and then top fieldname (all lowercase).

Field names are case sensitive

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Thu, 28 Jun 2018 13:21:43 GMT

Yes this works... is there a reason why when I run it on my own data it doesn't create a field?

Re: How to create a regex to extract string1 after the occurrence of string2?

jkat54 — Thu, 28 Jun 2018 13:32:18 GMT

What doesn’t work?

Does it work on 20% of your events but not 100% so you’re saying “it don’t work” or what?

You could change the

\w+ to \S+ or .+ to expand the regex so it matches more scenarios.

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Thu, 28 Jun 2018 13:50:34 GMT

I'm just not seeing the new field get created.
    I search for 

.....
| rex ‘catalog_name”:”(?<temp>\w+)”’ 
| top temp

and it returns no results found

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Thu, 28 Jun 2018 15:13:04 GMT

Nevermind this works, I was accidently still referencing the field=data field. removing this made it functional. Thank you!

Re: How to create a regex to extract string1 after the occurrence of string2?

jkat54 — Thu, 28 Jun 2018 15:18:27 GMT

Glad you figured it out! We were scratching our heads!

Re: How to create a regex to extract string1 after the occurrence of string2?

pladamsplunk — Thu, 28 Jun 2018 15:20:22 GMT

Sorry about that, I'm very new to using regex in splunk.