topic rex stop after first match in Splunk Search

rex stop after first match

poisar — Thu, 03 Dec 2020 20:06:24 GMT

i have a field with several strings like

fieldname = AT-field2-field3

fieldname = DE-field2

fieldname = DE-field2-field3-field4

etc...

I try to get a rex to just get the country code:

|rex field=fieldname "^(?<country>.*)-.*"

but the result is not just the Country Code

any ideas?

Re: rex stop after first match

richgalloway — Thu, 03 Dec 2020 20:30:46 GMT

The .* operator is greedy so it will grab as many characters as it can that still match the expression. One solution is to use the non-greedy quantifier.

|rex field=fieldname "^(?<country>.*?)-.*"

Another solution is to take everything up to the first hyphen. Like this:

| rex field=fieldname "^(?<country>[^-]+)-"

Re: rex stop after first match

poisar — Thu, 03 Dec 2020 22:21:05 GMT

thank you for your input. Both variants work and i learned something new 🙂