topic Re: Need assist with regex for extractions in Splunk Search

Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 16:08:44 GMT

I am trying to get some name space information from the clients inputs. the value I want is namespaceName. I am unfamiliar with regex and would like an assist if possible. This is the field I want:
, namespaceName=aqua2}, There is always a comma-space-namespaceName=-curly bracket-comma. (For example: , namespaceName=aqua2},

Destination app: Search
Name: nsName
Apply to: sourcetype
named:
Type: inline
Extraction/Transform: nsName=\s(?}

And I want this to be available for the users for their searches for the namespaceName values.

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 16:15:22 GMT

" Extraction/Transform: nsName=\s(?[\,\w "

Re: Need assist with regex for extractions

mayurr98 — Fri, 09 Aug 2019 16:15:50 GMT

try this run anywhere search:

| makeresults | eval data=", namespaceName=aqua2}," | rex field=data "\,\snamespaceName=(?<namespacename>[^\}]+)\}\,"

In your environment, you should try:

index=your_index | rex field=_raw "\,\snamespaceName=(?<namespacename>[^\}]+)\}\,"

let me know if this helps!

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 16:16:22 GMT

doggone it the wole line is not showing. there is a ( then a then the rest as shown

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 16:17:05 GMT

namespaceName is in between the \s and \w

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 17:35:06 GMT

Tried it in a search and it works, so do I just go to the Field Extensions and create it there?

Re: Need assist with regex for extractions

mayurr98 — Fri, 09 Aug 2019 17:51:32 GMT

Yes go to Settings » Fields » Field extractions » Add new and put \,\snamespaceName=(?<namespacename>[^\}]+)\}\, in Extraction/Transform.

Accept the answer if it works for you to close this question.

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 18:10:54 GMT

I accept the answer, it works wonderfully

Re: Need assist with regex for extractions

nls7010 — Fri, 09 Aug 2019 18:11:25 GMT

It worked well, thank you