topic extract text using regex in Splunk Search

extract text using regex

moayadalghamdi — Wed, 12 Jan 2022 11:55:40 GMT

hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables:

Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule

i want to perform a regex to extracted the first word out of each variable so the output would be:

risk

endpoint

network

thanks ^_^

Re: extract text using regex

gcusello — Wed, 12 Jan 2022 12:21:44 GMT

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

Re: extract text using regex

isoutamo — Wed, 12 Jan 2022 13:15:30 GMT

And as you want those with lower cases then add this

| makeresults | eval _raw ="Risk - 24 Hour Risk Threshold Exceeded - Rule Endpoint - machine with possible malware - fffff Network - Possible SQL injection - Rule" | multikv noheader=t ``` Above create test data ``` | rex "^(?<result>\w+)" | eval res = lower(result) | table res result _raw

r. Ismo

Re: extract text using regex

moayadalghamdi — Wed, 12 Jan 2022 13:20:19 GMT

you're really a legend, thanks mate splunker ^_^

Re: extract text using regex

moayadalghamdi — Wed, 12 Jan 2022 13:22:03 GMT

thanks for the answer ^_^