topic Re: extract part of path that may or may not contain space in Splunk Search

extract part of path that may or may not contain space

sarit_s — Wed, 30 Sep 2020 00:22:37 GMT

Hello

i have source path that looks like :

s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json

i want to extract "pjserialnumber"
but since i have space in "Star j750"
my regex is not working

rex field=source \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)

my problem is that i want to create a macro from this regex but not all the path's contain space

how can i fix both of the problems ?

thanks

Re: extract part of path that may or may not contain space

vnravikumar — Tue, 07 May 2019 11:03:19 GMT

Give a try

| makeresults 
| eval msg="s3://splunk/OTHER/1/OTHER/Star J750/pjserialnumber/2019-05-06T13:40:37.490Z_1.91.0.192_1.88.0.0_31.29.60.11592/metadata.json" 
| eval SerialNumber = mvindex(split(msg,"/") ,7)

Re: extract part of path that may or may not contain space

lakshman239 — Tue, 07 May 2019 11:05:42 GMT

You can change it to something like \/splunk\/\w+\/\w+\/\w+\/(?<SerialNumber>[^\/]*)\/

https://regex101.com/r/lcAZF0/3

Re: extract part of path that may or may not contain space

gouravdashtcs — Tue, 07 May 2019 11:13:29 GMT

Hello Sarit,

Kindly find the modified rex query for your reference.

rex field = source \/splunk\/\w+\/\w+\/\w+\/\w+\s+\w+\/(?\w+)

Re: extract part of path that may or may not contain space

sarit_s — Tue, 07 May 2019 11:15:25 GMT

this is taking the wrong part of the path

Re: extract part of path that may or may not contain space

sarit_s — Tue, 07 May 2019 11:15:35 GMT

work perfect !