topic rex field extraction in Splunk Search

rex field extraction

anoopambli — Mon, 28 Sep 2020 18:16:39 GMT

I am getting familiar with splunk commands, trying to extract hostname from an extracted field called monitor_name. monitor_name field data look like this,

[Linux][FWA Electronic Channel Messaging][l91oma1][Process][SS][/fiwlspoma4/was/INSTANCE1/profiles/base/servers/server1][error]
[Linux][Baseline][vlrtp569][Process][OSWatcher][SiSExclude]
[Linux][Baseline][vlrtp123][Process][srmclient][SiSExclude]

I would like to extract l91oma1, vlrtp569,vlrtp123 from the above field using rex command. Can someone help me with the regular expression.

Re: rex field extraction

kml_uvce — Fri, 28 Nov 2014 16:19:11 GMT

use this

rex field=_raw "^(?:[^\[\n]*\[){3}(?P<fieldname>\w+)"

Re: rex field extraction

aholzer — Fri, 28 Nov 2014 18:33:30 GMT

@kml_uvce your escaping backslashes were lost since you forgot to use the "code" tags around your regex. The regex should actually look like below:

rex field=_raw "^(?:[^\[\n]*[){3}(?P<fieldname>w+)"

Re: rex field extraction

somesoni2 — Fri, 28 Nov 2014 19:39:13 GMT

And there is backslash missing before "w+" as well. So it should be

rex field=_raw "^(?:[^\[\n]*[){3}(?P<fieldname>\w+)"

Re: rex field extraction

anoopambli — Mon, 01 Dec 2014 09:02:06 GMT

Thanks everyone, that helped me.

Re: rex field extraction

chimell — Sun, 11 Dec 2016 15:12:18 GMT

Hi anoopambli

This search code work well

...................................|rex max_match=0 field=_raw "\[Linux\]\[[a-zA-Z\s+]+\]\[(?<monitor_name>[^\]]+)\]"|mvexpand monitor_name|table monitor_name

Look at my result