topic Re: extract the value from the field using rex sed cmd in Splunk Search

How to extract the value from the field using rex sed cmd?

Babuduraiswamy — Fri, 13 Jan 2023 17:37:40 GMT

Hi,

I looking for rex sed cmd to extract the value from the field.
eg:

input field1 = d:\AppDynamics\machineagent\ver22.2.0.3282\bin\MachineAgentService.exe

output = ver22.2.0.3282

I need a valid sed cmd to filter the value everything before 3rd backslash and after 4th backslash.
eg: |rex field=version mode=sed "s/ /\*/g"

Thanks,

Babu

gcusello — Fri, 13 Jan 2023 07:05:14 GMT

sorry, let me understand: do you want to extract a field that's a part of field1 or replace a part of field1?

sec cmd is used to replace a part of a string, not for extract a field.

If you want to extract the third part of your path in field1, you can use a rex command like this:

| rex field=field1 "^\w:\\([^\\]+\\){2}(?<version>[^\\]+)"

Ciao.

Giuseppe

yuanliu — Fri, 13 Jan 2023 09:23:46 GMT

Given the rigidity of data format, another method is split and mvindex.

| eval output = mvindex(split(field1, "\\"), 3) ``` SPL array is 0-based ```

Searching fixed patterns is usually less expensive than regex.

Babuduraiswamy — Fri, 13 Jan 2023 19:25:30 GMT

Thanks, mvindex got worked..