topic find string between two given strings in splunk in Splunk Search

find string between two given strings in splunk

suruthyshree — Tue, 04 Jan 2011 19:33:13 GMT

How i can get the string between two given strings.

Log has entires like

22:09: DT : 2178we352njsdfh48734 : EF and so on.

I want to find fetch the values between "DT :" and ": EF". The "2178we352njsdfh48734" will vary based on the request and the "DT :" and ": EF": will remain same for all the request.

Re: find string between two given strings in splunk

southeringtonp — Wed, 05 Jan 2011 00:46:20 GMT

Generally, you want to either use rex or create a dedicated field extraction. For more complete information, look here.

Using rex:

In the search string, add the following to your search:

| rex field=xx "^\d+:\d+: DT : (?<txid>.*?) : EF"

For something more permanent, you can use:

transforms.conf:

[mytxid]
REGEX = "^\d+:\d+: DT : (.*?) : EF"
FORMAT = txid::$1

props.conf:

[yoursourcetype]
REPORT-txid = mytxid

Re: find string between two given strings in splunk

siri1410 — Fri, 27 Oct 2017 14:55:57 GMT

"search string" | rex field=_raw "DT : (?P[^\s]+) : EF" | dedup txid| table txid