topic Re: rex word extraction? in Splunk Search

rex word extraction?

rakesh_498115 — Tue, 18 Dec 2012 19:38:51 GMT

How can i write a regular expression to extract string starting with S and ends with 'E'.

I have used like this.

rex "^S(?<LOC>[.]*)E$"

, but not working ??

can you pls help

alacercogitatus — Tue, 18 Dec 2012 19:46:38 GMT

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

rakesh_498115 — Tue, 18 Dec 2012 19:53:13 GMT

how can include both S and E as well in the word extraction ??

Ayn — Tue, 18 Dec 2012 21:34:17 GMT

Just put them inside the matching group instead of outside.

alacercogitatus — Tue, 18 Dec 2012 21:36:42 GMT

Like This: | rex field=_raw "(?<LOC>S\w*E)"

rakesh_498115 — Wed, 19 Dec 2012 05:35:06 GMT

Thank you alacercogitatus

alacercogitatus — Wed, 19 Dec 2012 13:47:00 GMT

You are most welcome, please mark the answer as accepted if we have answered your question. Thanks!

nasamajh09 — Thu, 09 Jun 2016 23:08:40 GMT

What if I have to capture somewhere in the middle of the line , not from the begining , how rex can be used here .Please suggest

arihant16cse — Thu, 07 Feb 2019 05:50:04 GMT

| makeresults | eval aa="asssd sade bvc sfge" | eval bb=split(aa," ") *use this *