topic Re: How do I use regex to select a string between two symbols? in Splunk Search

How do I use regex to select a string between two symbols?

ss394546910 — Fri, 07 Oct 2022 20:28:15 GMT

Splunk logs looks like below:

userid=234user|rwe23|dwdwd --

userid=id123|34lod|2323 textHow can I get value between "=" and first "|"

I want to get table of value between "=" and first "|", like "234user" and "id123"

I tried:

index=indexhere "userid=" |regex "(?<==)(?<info>.+?)(?=\|)"
| dedup info
| table info

this one works fine in regex101, but shows 0 result in Splunk.
Could anyone please help? Any help would be appreciated. Thanks!

Re: How do I use regex to select a string between two symbols?

richgalloway — Fri, 07 Oct 2022 21:10:55 GMT

The regex command filters events - it does not extract fields. To extract fields, use the rex command. Also, avoid lookbehind in regexes - they're not necessary and take longer to process.

index=indexhere "userid=" | rex "userid=(?<info>[^\|]+?)" | dedup info | table info

Re: How do I use regex to select a string between two symbols?

yuanliu — Fri, 07 Oct 2022 21:11:06 GMT

Despite closeness in name, regex and rex are two very different commands. From regex:

regex
Description
Removes results that match or do not match the specified regular expression.

I think you are looking for rex.

index=indexhere "userid=" |rex "=(?<info>[^|]+)" | dedup info | table info

Re: How do I use regex to select a string between two symbols?

ss394546910 — Fri, 07 Oct 2022 21:38:51 GMT

Yes..seems like I am looking for rex not regex. Thanks for helping.