topic Re: How to extract two values from a string using regex? in Splunk Search

How to extract two values from a string using regex?

pc1234 — Mon, 08 Jun 2020 18:30:32 GMT

I'm requesting help constructing a regular expression for the following:

I need to extract two values from the string below:

[app/task/function/5]

field a='app' (string after first [ before first slash)
field b = '5' (value after last slash before closing])

Another example is:

[app/task/3]

fielda = app
fieldb= 3

In addition, I need the extraction to fail if a string of characters is found.
For example, the character string to exclude is 'function':

[function/app/2]

The extraction should fail since 'function' is contained in the string.

Any assistance would be appreciated.

Thanks in advance.

493669 — Tue, 02 Jun 2020 01:54:24 GMT

try @pc1234,
Updated:

...|rex "\[(?<field1>\w{3})\/.*\/(?<field2>\d)\]"

pc1234 — Tue, 02 Jun 2020 03:12:12 GMT

that only extracts the first value. it also doesn't address failing if a string of characters is found(see above)

493669 — Tue, 02 Jun 2020 03:22:40 GMT

I updated answer please try again

gcusello — Tue, 02 Jun 2020 08:23:41 GMT

Hi @pc1234,
use these two regexes:

| rex "^field\s*a\s*\=\s*(\'|\s)(?<fielda>\w+)"
| rex "^field\s*b\s*\=\s*(\'|\s)(?<fielda>\d+)"

Ciao.
Giuseppe