topic Re: Splunk Regex Field Extractions in Splunk Search

Splunk Regex Field Extractions

franciscoz1 — Wed, 06 Mar 2024 20:27:51 GMT

When writing regex, where in the regex string am I supposed to add the (?<new_field>) string ?

I have included a sample regex string below, where in this string would I add (?<new_field>) ?

(?<=\:\[)(.*)(?=\])

Thanks !

bowesmana — Wed, 06 Mar 2024 20:42:33 GMT

If that is the exact regex and you are talking about using the rex command, then

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

will extract the data between the [] into new_field

franciscoz1 — Wed, 06 Mar 2024 20:55:53 GMT

Worked like a charm, thank you !