topic Extract multiple words in a filed in Splunk Search

Extract multiple words in a filed

marco_massari11 — Wed, 02 Dec 2020 10:53:39 GMT

Hi,

I have some syslog logs and I need to extract the first words of a field values. The field value starts like this:

Site Corporate Windows AM\\Passed\\

My result should be :

Corporate Passed

Note: I can have also Unmanaged instead of Corporate and Failed insted of Passed, so I have 4 options:

Corporate Passed

Corporate Failed

Unmanaged Passed

Unmanaged Failed

493669 — Wed, 02 Dec 2020 13:31:16 GMT

@marco_massari11 if you want extract multiple fields then try below-
Updated-

Site (?<field1>\w+)[^\\\\]+\\\\(?<field2>\w+)

It will extract in field1 and field2.

-------
let me know if it helps!

marco_massari11 — Wed, 02 Dec 2020 12:12:51 GMT

Hi @493669 I have this message error Regex: missing terminating ] for character class.

nickhills — Wed, 02 Dec 2020 13:27:54 GMT

That happens because of some additional escaping which is needed.

Try this version, which avoids needing a triple \

Site (?<site>\w+).+\\\\(?<result>\w+)