topic How to search a string in Splunk Search

How to search a string

RGullur — Wed, 22 Jan 2025 19:29:57 GMT

Hi Community, please help me how to extract BOLD/underlines value from below string:

[2025-01-22 13:33:33,899] INFO Setting connector ABC_SOMECONNECTOR_CHANGE_EVENT_SRC_Q_V1 state to PAUSED (org.apache.kafka.connect.runtime.Worker:1391)

Re: How to search a string

dural_yyz — Wed, 22 Jan 2025 20:28:39 GMT

The regex is simple enough.

^.*\sSetting\sconnector\s(?<connector_event>[^\s]+).*$

Re: How to search a string

bowesmana — Wed, 22 Jan 2025 20:52:38 GMT

As @dural_yyz says, the regex is easy - you can use this with the rex command

https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/rex

Re: How to search a string

PickleRick — Wed, 22 Jan 2025 20:53:00 GMT

Anchoring the regex to the beginning of the string is not needed and actually significantly impacts the performance (match in 154 steps vs. 29 without the "^.*" part).

Re: How to search a string

yuanliu — Sun, 26 Jan 2025 07:00:24 GMT

Combining everyone's suggestions, here is a command that is ready to go if that string is all you need:

| rex "Setting connector (<myfield>\S+)"

How strictly or loosely you want to set anchors and matches heavily depends on actual data and use case. This is just something to get you started.

Re: How to search a string

isoutamo — Sun, 26 Jan 2025 21:56:44 GMT

regex101.com is excellent place to try how these rex are working or not. It also show execution cost of different versions and contains some other help.