topic Re: How to apply regex to lookup table field? in Splunk Search

How to apply regex to lookup table field?

Taruchit — Tue, 21 Nov 2023 14:28:32 GMT

Hello All,

I have a lookup file with multiple fields. I am reading it using inputlookup command and implementing some filters. Now I need to apply regex on a field and extract the corresponding matched string from each row of the lookup into a separate field.

The regex is: xxx[\_\w]+:([a-z_]+)

Thus, I need your guidance and inputs to build the same.

Thank you

Taruchit

Re: How to apply regex to lookup table field?

ITWhisperer — Tue, 21 Nov 2023 14:44:10 GMT

You need to specify a field that you wish the extracted pattern to be put in - for example:

xxx[\_\w]+:(?<fieldname>[a-z_]+)

Re: How to apply regex to lookup table field?

Taruchit — Tue, 21 Nov 2023 14:56:47 GMT

Hello @ITWhisperer,

Thank you for your response.

Can you please help with example of how to write the code?

|inputlookup myTable.csv |where _time=relative_time(now(),"-1d@d")

Now I need to apply the regular expression on fieldA and store the extracted data from each row in field: res.

It would be very helpful if you could help.

Thank you

Re: How to apply regex to lookup table field?

ITWhisperer — Tue, 21 Nov 2023 15:13:04 GMT

| rex field=fieldA "xxx[\_\w]+:(?<res>[a-z_]+)"

Re: How to apply regex to lookup table field?

Taruchit — Tue, 21 Nov 2023 15:48:23 GMT

Thank you @ITWhisperer for your prompt help.