topic Re: Extract only first occurrence between two strings in the paragraph of string in splunk in Splunk Search

How to extract only first occurrence between two strings in the paragraph of string in Splunk?

rpachamuthu — Fri, 21 Apr 2023 18:15:26 GMT

Extract only first occurrence between two strings in the paragraph of string in splunk

index=perf-*** source=*ResponseDataErrorAnalyzer*
|rex field=_raw "scriptnamestart(?<ScriptName>[\w\D]+)scriptnameend"
|table ScriptName

I want to capture the first occurrence an store in the ScriptName and display in the table data
scriptnamestartreceiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Getscriptnameend<someText>

Re: Extract only first occurrence between two strings in the paragraph of string in splunk

richgalloway — Fri, 21 Apr 2023 17:01:03 GMT

You have expressed a desire and provided a means to achieve that desire. How did the query fail you?

By default, the rex command will return only the first match. According to regex101.com, your query should return "receiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Get" from the sample text. Is that not what you want?

Re: Extract only first occurrence between two strings in the paragraph of string in splunk

rut — Fri, 21 Apr 2023 17:35:34 GMT

The match continues until the second instance of “scriptnameend”. The following pattern uses a lookahead, so it should break at the first instance of “scriptnameend”:

| rex field=_raw "scriptnamestart(?<ScriptName>.+?(?=scriptnameend))scriptnameend"

I tested the above, it returns “receiving_S02_sat_Get”.

Re: Extract only first occurrence between two strings in the paragraph of string in splunk

richgalloway — Fri, 21 Apr 2023 17:55:35 GMT

I missed the embedded terminator. Use a non-greedy quantifier to stop at the first occurrence.

| rex "scriptnamestart(?<ScriptName>[\w\D]+?)scriptnameend"

Re: Extract only first occurrence between two strings in the paragraph of string in splunk

rut — Fri, 21 Apr 2023 18:09:09 GMT

That's a more effective pattern (148 vs 178 steps), use @richgalloway's pattern :)!