topic Re: Regex Match Help! in Splunk Search

How to regex match?

kc_prane — Wed, 16 Feb 2022 04:38:51 GMT

Hi,

This is a raw log Job=[IN-SNMMIS-DLY]],

I am trying to build regex just the words " IN-SNMMIS-DLY]"

and ignore the parenthesis

Re: Regex Match Help!

ITWhisperer — Mon, 14 Feb 2022 05:59:56 GMT

| rex "Job=\[(?<job>[^\]]+)\]"

Re: Regex Match Help!

yuanliu — Mon, 14 Feb 2022 03:58:20 GMT

I think @ITWhisperer pressed Enter before complete typing. (This happened to me today, too. Something on the forum interface might be off.) Assuming the field Job is already extracted, a usable regex would be "^\[.+\]$". To use in rex command:

|rex field=Job "^\[(?<Job_no_bracket>.+)\]$"

If Job is not extracted and you are only interested in the part inside brackets,

| rex "=\[(?<Job_no_bracket>.+)\]$"

This last one only works if there's nothing after "Job=[IN-SNMMIS-DLY]]" in _raw.

Re: Regex Match Help!

kc_prane — Wed, 16 Feb 2022 04:35:10 GMT

Thankyou@ITWhisperer

Re: Regex Match Help!

kc_prane — Wed, 16 Feb 2022 04:36:19 GMT

Thanks a lot, @Yuanilu that regex worked for me.