topic Re: regex in Splunk Search

How do I extract using regex?

sphiwee — Wed, 23 Nov 2022 14:03:40 GMT

i have below result, how can I do a regex to extract the fields, first being DateTime, username, Action, Entity

2022-11-21 15:44:13,ea186520,CREATED,USERSESSIONLOG

Re: regex

yuanliu — Wed, 23 Nov 2022 07:53:49 GMT

It quite depends on how stable is the actual data format. If all values have no comma in them as illustrated, you can simply do

| rex "(?<DateTime>[^,]+, *(?<username>[^,]+), *(?<Action>[^,]+), *(?<Entity>[^,]+)"

Re: regex

gcusello — Wed, 23 Nov 2022 07:55:07 GMT

Hi @sphiwee,

you can use the Field User Extractor to extract these fields without using regexes, cebause they are comma separated fields.

If you want to use a regex, you can use this:

| rex "^(?<DateTime>[^,]*),(?<username>[^,]*),(?<Action>[^,]*),(?<Entity>[^,]*)"

that you can test at https://regex101.com/r/KMPkSa/1

Ciao.

Giuseppe