topic Re: Field Extraction in Splunk Search

Field Extraction

scout29 — Fri, 22 Nov 2024 16:28:20 GMT

Need help to extract a field that comes after a certain word in a event.

I am looking to extract a field called "sn_grp" with the value of "M2 Infra Ops". So for every event that has sn_grp: i would like to extract the string that follows of "M2 Infra Ops". This string value will be the same name for every event.

Below is an example data set i am using to write the regex to

\"sn_grp:M2 Infra Ops\"},{\"context\":\"CONTEXTLESS\",\"key\":\"Correspondence Routing Engine\

Re: Field Extraction

richgalloway — Fri, 22 Nov 2024 17:06:12 GMT

This should get you started.

| rex "sn_grp:(?<sn_grp>[^\\]+)"

Re: Field Extraction

scout29 — Fri, 22 Nov 2024 17:04:19 GMT

That seems to work however it is capturing the "\" in the string at the end. I want the value to stop after Ops in the string and not include the "\"

Re: Field Extraction

richgalloway — Fri, 22 Nov 2024 17:06:31 GMT

Try my revised answer.