topic Re: Extract the words after Result=xxx in Splunk Search

Extract the words after Result=xxx

Satcom9 — Wed, 04 Sep 2024 00:40:52 GMT

ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found

I want to extract the words that come after Result=XXX And not include the Result=xxx in the output.

|rex field=Message "(?<Test>\bResult.*\D+)" This produces this output>>> Result=110 No Insertion Channel Found.

So I want to exclude the Results=XXX

Re: Extract the words after Result=xxx

inventsekar — Wed, 04 Sep 2024 00:53:10 GMT

Hi @Satcom9

Pls check this(just a little tweak of your rex):

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=110(?<Test>\D+)" | table Message Test

but the 110 should not hard-coded.. try this instead. thanks.

Re: Extract the words after Result=xxx

Satcom9 — Wed, 04 Sep 2024 14:10:07 GMT

|rex field=Message "Result=\d\d\d\s(?<Test>.*)"

I replaced yours with mine and it works perfectly for what I was looking for, TY for the response.