topic Re: Field Extraction help!! in Splunk Search

Field Extraction help!!

splunker9999 — Tue, 29 Sep 2020 08:53:46 GMT

Hi ,

We have sample data like below and need to extract these fields:
"GB*2" with field value as "NC-MEDICAL" and "GI*" as "NC-Medical"

****20150816*1603*34578*X*1879642~ST*270*000000001*1879642~BHT*0022*13*PHX*20150816*1603~LG*120*1~NM1******GB*2*NC-MEDICAL***GI*NC-MEDICAL*****

Can someone please help us with field extraction?

Thanks
Sarath

richgalloway — Tue, 23 Feb 2016 14:43:17 GMT

This regular expression will extract those fields.

"GB\*2\*(?<GB2>[^\*]+)\*\*GI\*(?<GI>[^\*]+)"

splunker9999 — Wed, 24 Feb 2016 20:30:30 GMT

Thank you , this works.