topic Re: extract content of brackets in Splunk Search

extract content of brackets

indeed_2000 — Wed, 22 Apr 2020 05:45:16 GMT

how can i extract content of first bracket if it is string?

e.g:
2020-04-21 23:59:59,093 INFO xxx.xxx-zz-00000 [process] start[ppp] time[00] tag[xxx]
2020-04-21 23:59:59,093 INFO xxx.xxx-zz-00000 [1234567] start[ppp] time[00] tag[xxx]
....

expected result:
process

have huge log file need to extract process with this conditions
1-content of first bracket
2-it must be string not number!

Thanks,

Re: extract content of brackets

javiergn — Wed, 22 Apr 2020 08:58:16 GMT

Hi @mehrdad_2000,

If you just want whatever is between square brackets but ensuring it only contains letters and not numbers, you can do something like:

| rex max_match=1 "^\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\,\d{3} \w+ [\w\-\.]+ \[(?<myField>[a-zA-Z]+)\]"

For instance, if I use your sample data:

Re: extract content of brackets

indeed_2000 — Wed, 22 Apr 2020 12:04:44 GMT

As I mentioned this is large log file and need more complete regex to do this.
For example your answer extract only fixed pattern that i mention, but not work on these:

2020-04-21 23:59:59,093 INFO xxxx.xxxxx-zz-00000xxx111 [process] start[ppp] time[00] tag[xxx]
2020-04-21 23:59:59,093 INFO xx.xxx-zz-00000x [report] start[ppp] time[00] tag[xxx]

Expected output:
process
report

Re: extract content of brackets

javiergn — Thu, 23 Apr 2020 13:04:54 GMT

Hmm, that's interesting. I have tested both your samples on regex101 and my regex works fine with them. Look:

https://regex101.com/r/cjjSHZ/1