topic Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right) in Splunk Search

Regex to extract the end of a string (from a field) before a specific character (starting form the right)

mdeterville — Sat, 18 Jan 2020 04:21:06 GMT

Hi Everyone:

I'd like to extract everything before the first "=" below (starting from the right):

sender=john&uid=johndoe

Note: I will be dealing with varying uid's and string lengths.

Any assistance would be greatly appreciated.

Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right)

richgalloway — Sat, 18 Jan 2020 18:22:23 GMT

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"

Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right)

woodcock — Sat, 18 Jan 2020 18:47:05 GMT

Even more generic, try this:

| rex "(?<last_word>[^=]+$)"

Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right)

to4kawa — Sat, 18 Jan 2020 23:52:29 GMT

Plan A:

| makeresults
| eval _raw="something_time something  test=foobaa&sender=john&uid=johndoe"
| extract pairdelim="&" kvdelim="="
| eval uid_length=len(uid)

It may not be so easy, I tried to extract from _raw.

Plan B:

| makeresults
| eval your_field="foobaa&sender=john&uid=johndoe"
| eval tmp=mvindex(split(your_field,"&"),mvfind(split(your_field,"&"),"uid"))
| eval uid=mvindex(split(tmp,"="),1)
| eval uid_length=len(uid)

All plans are REGEX-free

Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right)

mdeterville — Mon, 20 Jan 2020 14:54:56 GMT

This worked, thank you so much!