topic Re: Extract the data after second special character in Splunk Search

How to Extract the data after second special character?

Neel881 — Thu, 17 Aug 2023 18:07:34 GMT

Hello,

I want the extract everything after the second slash(/)

Everything from the last till the first slash (/) -- Both scenario works for me

Example -

generation/abcd/giveandtake-messages-to-s

generation/xyz/giveandtake-messages-speedline-s

ITWhisperer — Thu, 17 Aug 2023 11:08:00 GMT

| rex ".+/.+/(?<message>.*)"

PickleRick — Thu, 17 Aug 2023 11:19:27 GMT

Restricting the firs two strings to character classes

[^/]+/[^/]+/(?<message>.*)

gives big performance boost (prevents backtracking).

Neel881 — Thu, 17 Aug 2023 11:32:28 GMT

Thank you!

Can we do from the end as well? Right to left till the special charater?

PickleRick — Thu, 17 Aug 2023 11:49:29 GMT

If you want to capture everything after the last slash, you can do something like

.*/(?<message>[^/]*)$

ITWhisperer — Thu, 17 Aug 2023 11:52:06 GMT

/(?<message>[^/]+)$

Neel881 — Thu, 17 Aug 2023 11:54:37 GMT

Perfect! Thanks