topic Re: How to extract two fields using regex? in Splunk Search

How to extract two fields using regex?

karthi2809 — Wed, 13 Mar 2024 11:12:15 GMT

How to extract the two fields from the message ?

In this need to extract after API: START: /v1/expense/extract/demand/

nagl as one field .

demand _con.csv in another field

I am extracting

|rex field=message max_match=0 "API: START: /v1/expense/extract/odemand/ (?<OnDemandFileName>[^\n]\w+\S+)"

API: START: /v1/expense/extract/demand/nagl/demand_con.csv

gcusello — Wed, 13 Mar 2024 11:41:04 GMT

if the first field is called app and the second is called OnDemandFileName, you can use this regex:

|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"

Ciao.

Giuseppe

ITWhisperer — Wed, 13 Mar 2024 11:43:04 GMT

Try something like this

|rex field=message max_match=0 "API: START: /v1/expense/extract/demand/(?<oneField>[^\/]+)\/(?<anotherField>\S+)"

karthi2809 — Wed, 13 Mar 2024 12:11:52 GMT

Working 👍