topic Re: How to create a regex to extract fields between two hyphens? in Splunk Search

How to create a regex to extract fields between two hyphens?

Deepz2612 — Tue, 18 Jun 2019 13:49:34 GMT

Hi,help me in writing regex to extract field between two hyhpens.

Eg: S-STRA-32
F-FIDR-67

Thanks!

Re: How to create a regex to extract fields between two hyphens?

harsmarvania57 — Tue, 18 Jun 2019 14:17:06 GMT

Hi,

Please try below regex, it will extract data in new field called extracted_field

<yourBaseSearch>
| rex field=<yourfield> "^[^\-]+\-(?<extracted_field>[^\-]+)\-"

Re: How to create a regex to extract fields between two hyphens?

VatsalJagani — Tue, 18 Jun 2019 14:17:18 GMT

Hello @Deepz2612,

Please try regex: -(?<your_field>.*)-. You will get value between two hyphen in "your_field" field.

This will work but if you have further information about elements on both side of hyphen you can make regex faster. For example I'm assuming we have only one characters on left side of hyphen and some digits on right side of hyphen we can use regex: [a-zA-Z]-(?<your_field>.*)-\d+.

Hope this helps!!!

Re: How to create a regex to extract fields between two hyphens?

pranay_adla — Tue, 18 Jun 2019 14:34:34 GMT

   | rex field=<yourfield> "\-(?P<field_name>\w+)\-"

Re: How to create a regex to extract fields between two hyphens?

vnravikumar — Tue, 18 Jun 2019 15:23:44 GMT

Try this

| makeresults 
| eval str="F-FIDR-67" 
| eval result = mvindex(split(str,"-"),1)

Re: How to create a regex to extract fields between two hyphens?

woodcock — Tue, 18 Jun 2019 17:13:52 GMT

Add this to your search:

... | rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"

This captures multiples, even sequentials like when you do this, which the others do not:

|makeresults | eval _raw="foo-bar-bat-boo"
| rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"