topic Re: How do you extract a field between 2 fixed words? in Splunk Search

How do you extract a field between 2 fixed words?

clarkedayne — Fri, 29 Mar 2019 03:57:39 GMT

Need help extracting\creating a new field between 2 fixed words.

Example:

!CASH OUT         $100.00!                        !TOTAL

!CASH OUT and !TOTAL are fixed, but the value amount in between ($100.00) changes. I would like to create a field, so I can field the events by the cash out amount ect.

I have tried the below search, but it doesn't return any results

"!CASH OUT" "!TOTAL" | rex "!CASH OUT (?[^!]+)!TOTAL"

Thank you, any assistance will be much appreciated

Re: How do you extract a field between 2 fixed words?

clarkedayne — Fri, 29 Mar 2019 03:58:24 GMT

Edit: I have tried the below search rather
"!CASH OUT" "!TOTAL" | rex "!CASH OUT (?[^!]+)!TOTAL"

Re: How do you extract a field between 2 fixed words?

vnravikumar — Fri, 29 Mar 2019 10:00:34 GMT

Try this rex

!CASH\sOUT\s(?P<output>.+)\s!TOTAL

!CASH\sOUT\s(?P<output>[^!]+)!\s!TOTAL

Re: How do you extract a field between 2 fixed words?

woodcock — Mon, 01 Apr 2019 04:55:17 GMT

Like this:

| makeresults 
| eval _raw="!CASH OUT         $100.00!                        !TOTAL"
| rex "!CASH\s+OUT\s+\$(?<cash>[\d\.]+)!\s+!TOTAL"