topic Re: REgex to extract fields in Splunk Search

REgex to extract fields

hashsplunk — Mon, 22 Mar 2021 13:05:03 GMT

AZImaging/Projects/IMG2012002/WSI/D419BC00001/E7004004/SM/96b819b9-fc86-b81b-a999-55a72df0e05a.svs

Hi ,

Above is the string which i want to extract 2 fields . IMG2012002 and D419BC00001. First value after 2 slashes and second value after 4 slashes .

How can i write a regular expression for that ? Please help

gcusello — Mon, 22 Mar 2021 13:09:38 GMT

please try this regex:

| rex "\w+\/\w+\/(?<field_1>\w+)\/\w+\/(?<field_2>\w+)"

if the string you shared is in a field, you could modify the rex in this way:

| rex field=your_field "^\w+\/\w+\/(?<field_1>\w+)\/\w+\/(?<field_2>\w+)"

Ciao.

Giuseppe

richgalloway — Mon, 22 Mar 2021 13:12:36 GMT

([^\/]+\/){2}(?<first>[^\/]+)\/[^\/]+\/(?<second>[^\/]+)

regex101.com is great for experimenting with regular expressions.