topic Re: Can you help me with the following regex expression? in Splunk Search

Can you help me with the following regex expression?

zacksoft — Wed, 24 Oct 2018 11:51:06 GMT

I have events from which I need to extract the strings that fall before the string "raced to road"

Here is a sample event:

'com.pyxis.greengoblin.phutan' - 'PhutanAgile'  raced to road.
            Error creating bean with name 'sampleDataGeneratorImpl' defined in URL [bundle://187.0:1/com/bsassian/greengoblin/sampledata/SampleDataGeneratorImpl.class]:
It was loaded from /bsahare/bsaassian/application-data/jirabiz/plugins/installed-plugins/plugin.8763102878749631573.loovytuner-5.5.28.jar    
        'com.bsa.phutan.plugins.bsa-development-integration-blogin' - 'Bsassian Phutan - blogins - Development Integration blogin'  raced to road.

The Strings that need to be extracted in the above sample events are 'PhutanAgile' and 'Bsassian Phutan - blogins - Development Integration blogin'

Re: Can you help me with the following regex expression?

Azeemering — Wed, 24 Oct 2018 12:11:11 GMT

Something like this?

.+?(?=raced to road)

https://regex101.com/r/0A66nK/1

Re: Can you help me with the following regex expression?

493669 — Wed, 24 Oct 2018 12:54:31 GMT

Hi @zacksoft,
Try this:

|rex max_match=0 "(?<a>[^']+)\'\s*raced to road"

Re: Can you help me with the following regex expression?

FrankVl — Wed, 24 Oct 2018 13:24:32 GMT

Almost, but he doesn't want the entire string, just the bit in between ' right in front of "raced to road".

So it should be: [^\']+?(?=\'\s+raced to road)
https://regex101.com/r/0A66nK/2

But the solution presented by @493669 seems to be a lot more efficient (factor 30 in steps reported by regex101).

Re: Can you help me with the following regex expression?

ddrillic — Wed, 24 Oct 2018 13:55:53 GMT

The simplistic (.*)raced to road. extracts it ; - )

Re: Can you help me with the following regex expression?

zacksoft — Wed, 24 Oct 2018 14:28:50 GMT

@493669 Thanks for the help. Where is the extracted string getting stored. I need to use the extracted string in a table command.

Re: Can you help me with the following regex expression?

493669 — Wed, 24 Oct 2018 14:46:03 GMT

field is extracted in fieldname a you can change as per your need to show it in table