topic Re: Regex help - in Splunk Search

How to extract container name and ID from a log using regex?

pavanmishra0102 — Mon, 31 Aug 2020 23:35:58 GMT

(Item Id: 45) Container Name: Abc Admin Accounts (Container Id: 19) suid=1

need to extract Container name & Container id from the above partial log posted here using regex. Kindly help. Thanks in advance

Re: Regex help -

isoutamo — Mon, 31 Aug 2020 13:25:29 GMT

this helps you:

index=_internal | head 1 | eval _raw ="(Item Id: 45) Container Name: Abc Admin Accounts (Container Id: 19) suid=1" | rename COMMENT "Previous sets sample data, next line select values" | rex "Container Name: (?<CName>[^\(]+)\(Container Id: (?<CId>\d+)"

r. Ismo

Re: Regex help -

rnowitzki — Mon, 31 Aug 2020 13:26:03 GMT

Hi @pavanmishra0102 ,

This should do it:

Container\sName:\s(?<container_name>.*)\((?<=\()Container\sId:\s(?<container_id>\d+)\)

BR
Ralph
--
Karma and/or Solution tagging appreciated.