topic HOW TO GET FULL NAME USING REGEX FROM RAW DATA in Splunk Search

HOW TO GET FULL NAME USING REGEX FROM RAW DATA

hrs2019 — Sat, 13 Nov 2021 15:11:55 GMT

Hello
How i can get the full name from log ie. Name=Busaram Manjraj
i am trying with this regex |rex field=-_raw "(?<Name>[^&]+)\s*\d*"
but it is giving just Name=Busaram not the full name.

Splunk raw data looks like
Name=Busaram, Manjraj

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

ashvinpandey — Sat, 13 Nov 2021 15:21:38 GMT

@hrs2019 Can you please share the full raw log ?

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

PickleRick — Sat, 13 Nov 2021 16:19:00 GMT

Firstly, if you want the regex not to capture the "Name=" part, you should specify it explicitly before the capture group.

Name=(?<Name>[^&]+)\s*\d*

Secondly, for me, it works (if you give proper field name):

Thirdly, why the \d* at the end? You have more data you're not showing us?

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

hrs2019 — Sat, 13 Nov 2021 16:34:38 GMT

@PickleRick Thanks for your reply i have added the screenshot for my output please have a look and the log also.

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

hrs2019 — Sat, 13 Nov 2021 16:35:36 GMT

added.

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

PickleRick — Sat, 13 Nov 2021 17:02:53 GMT

I don't know what your "-_raw" field is supposed to mean. The field name (with an exception for splunk's internal field like _raw or _time) has to start on a letter. Drop the "field=" option completely (even with matching _raw, you shouldn't use it - the rex command matches to _raw by default and specifying it explicitly can have performance impact - at least that's what the docs say).

If you match your regex to whole event, you should... get all event up to any apersand ("&") signs.

Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA

bhargavi — Mon, 15 Nov 2021 06:39:38 GMT

Hi @hrs2019

Try this.

| rex "Name=(?P<Name>\w+\,\s\w+)"