topic Regex to extract parts of a string delimited by dost (.) in Splunk Search

Regex to extract parts of a string delimited by dost (.)

cindygibbs_08 — Fri, 23 Jul 2021 03:21:26 GMT

Hello my loves I have one quick question

Lets say I have this two strings

AUJ.UEIEJ.829839.239383

033.4788383.27383.8HJJJ

WHat would be the correct regex expression to extract ONLY string of characters after the first dot and before the second dot.. that means

from AUJ.UEIEJ.829839.239383 I want UEIEJ
from 033.4788383.27383.8HJJJ I want 4788383

Thank you my loves for the help!

kindly,

Re: Regex to extract parts of a string delimited by dost (.)

venkatasri — Fri, 23 Jul 2021 05:18:02 GMT

Hi @cindygibbs_08

Can you try this?

| makeresults | eval x="AUJ.UEIEJ.829839.239383" | rex field=x "\.(?<field1>.+?)\."

---

An upvote would be appreciated if this reply helps and Accept the solution!

Re: Regex to extract parts of a string delimited by dost (.)

venkatasri — Fri, 23 Jul 2021 05:20:02 GMT

@cindygibbs_08 Assumed your field name as x (replace with your field name) which containing a string value. If the string is part of _raw event and not been extracted already this might not work.

Re: Regex to extract parts of a string delimited by dost (.)

ITWhisperer — Fri, 23 Jul 2021 06:01:32 GMT

| rex "^[\.]+\.(?<string>[^\.]+)\."