topic Re: rex to extract string in Splunk Search

rex to extract string

indeed_2000 — Wed, 02 Feb 2022 09:03:12 GMT

Hi I have log like this:

2022-02-01 11:59:59,869 INFO CUS.AbCD-Host-000000 [AppListener] Receive Packet[0000000*]: Cluster[String1.String2]

How can I extract String1 and String2 separately with a single rex like this?

Cluster\[(?<GroupREX>\w+\.\w+)

Any idea?

Thanks,

ITWhisperer — Wed, 02 Feb 2022 09:07:04 GMT

Cluster\[(?<String1>\w+)\.(?<String2>\w+)\]

gcusello — Wed, 02 Feb 2022 09:14:32 GMT

if you're sure that the division between strings is dot, you could use a regex like this:

| rex "Cluster\[(?<string1>[^\.]+)\.(?<string2>[^\]]+)"

Ciao.

Giuseppe