topic Getting data out of an event with a regular expression in Splunk Search

Getting data out of an event with a regular expression

MattPainting — Tue, 06 Oct 2020 16:01:40 GMT

I am trying to figure out how to get data out of the event and into a field. I need to get all the data in brackets.

Sample data:

Run,jump,fly[walk]dog/cat

File storage ,[app - run] development

I want the result put into a new field and look like this:

walk

app - run

ITWhisperer — Tue, 06 Oct 2020 16:02:18 GMT

| rex "\[(?<result>[^\]]+)"

use max_match=0 if there is more than one bracketed result in an event

gcusello — Tue, 06 Oct 2020 16:04:26 GMT

if you want to extarct a field from a log, I hint to use the guided self extractor.

Anyway, using a regex, you can extract the value between square parenthesis putting it into a field:

| rex "\[(?<my_field>[^\]]+)"

Ciao.

Giuseppe