topic Re: regex to match everything between the 25th and 130th characters in a line in Splunk Search

regex to match everything between the 25th and 130th characters in a line

mritenburg — Thu, 20 Dec 2012 16:52:46 GMT

Hello,

I am trying to craft a regex to match everything between the 25th and 130th character in a line. I am having no success. Someone suggested ^.{25} (?P<FIELDNAME>.{130} but that doesn't work at all. Does anyone know how to create this regex?

Thank you!

Re: regex to match everything between the 25th and 130th characters in a line

alacercogitatus — Thu, 20 Dec 2012 17:34:35 GMT

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

Re: regex to match everything between the 25th and 130th characters in a line

rtadams89 — Thu, 20 Dec 2012 18:09:12 GMT

Depending on what you are trying to accomplish, you may be better off using the eval substr() function. For example:

... | eval newField=substr(field, 26, 104)

Otherwise, you can use this regex to extract the same thing:

^.{25}(?P<newField>.{0,105})

Re: regex to match everything between the 25th and 130th characters in a line

mritenburg — Thu, 20 Dec 2012 18:11:37 GMT

This works perfectly ^.{25}(?P.{1,105}).

Thank you!