topic Regex for extraction of Pattern from existing field in Splunk Search

Regex for extraction of Pattern from existing field

Sourabhv05 — Sun, 24 May 2015 22:00:48 GMT

I want to extract a pattern from existing field "source" whose value is /abc/Prod/log/p123ot12. I want to extract p123ot12 from this source field and want to put it in new field called job.

Need your assistance ASAP.

Re: Regex for extraction of Pattern from existing field

MuS — Sun, 24 May 2015 22:40:44 GMT

Hi Sourabhv05,

So, you want an answer asap 😉

Your regex is pretty easy, you're looking for everything after the last / so try this:

your base search goes here | rex field=source "(?<job>[^\/]*)$" | table job

This will extract everything after the last / and put it in a field called job.

You can test and learn regex over here https://regex101.com

Hope that helps and was asap enough 😉

cheers, MuS

Re: Regex for extraction of Pattern from existing field

Sourabhv05 — Sun, 24 May 2015 22:46:39 GMT

Hi Mus,

I am getting error while pasting this regex after my search. Error is Error in 'SearchOperator:regex': Usage: regex <field> (=|!=) <regex>.

My base search is index = abc host = "xyz"

When i have put it like index = abc host = "xyz" |regex field=source "(?<job>[^\/]*)$" | table job it gave me above error. Please help

Re: Regex for extraction of Pattern from existing field

MuS — Sun, 24 May 2015 22:53:23 GMT

Well do you have a field called source? Try rex instead of regex and if it's still not working try this:

 index=abc host="xyz" |rex "(?&lt;job&gt;[^/]*)$" | table job

Re: Regex for extraction of Pattern from existing field

Sourabhv05 — Sun, 24 May 2015 22:58:51 GMT

thanks alot Mus. It works perfectly.

Re: Regex for extraction of Pattern from existing field

Sourabhv05 — Sun, 24 May 2015 23:07:35 GMT

I need one more help. I have a pattern ABCDEF**** in my logs which are getting indexed on Splunk . I need to put that pattern in an field which i want to display in table along with job, How can i do that ?

Re: Regex for extraction of Pattern from existing field

MuS — Sun, 24 May 2015 23:14:05 GMT

Okay, instead of asking for more help; Why don't you read the docs about the field extractor http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX and learn how to use it. It helps you to get anything out of your events into fields, which then can be used in any further search within the same app. Make your life much easier 😉

Re: Regex for extraction of Pattern from existing field

esix_splunk — Mon, 25 May 2015 03:27:16 GMT

Add the field called source to your table..

... | table source , myfield1, myfield2, myfieldN

Re: Regex for extraction of Pattern from existing field

MuS — Mon, 25 May 2015 04:33:59 GMT

Uppsss, my bad. looks like I got the additional question wrong 😉