topic Re: How to extract a string located between two backslashes in a field? in Splunk Search

How to extract a string located between two backslashes in a field?

marktechuk — Tue, 15 Nov 2016 16:46:27 GMT

Hi guys I'm new to Splunk 🙂

A search I created returns the following in a specific field: /Erginn008/3e2ce24a277ggh9/e709d1a.json

I'm looking to extract the Erginn008 between the first 2 backslashes?

Any help appreciated thanks.

Re: How to extract a string located between two backslashes in a field?

richgalloway — Tue, 15 Nov 2016 16:59:51 GMT

You can do it at search time using rex.

... | rex field=myField "\/(?<newField>[^\/]+)" | ...

Re: How to extract a string located between two backslashes in a field?

marktechuk — Tue, 15 Nov 2016 17:12:51 GMT

Thanks Rich, Tried this but getting an error

sourcetype=proxy github.com cs_uri_path!=/ cs_uri_path="*" |rex cs_uri_path="*" "\/(?[^\/]+)" |

Re: How to extract a string located between two backslashes in a field?

richgalloway — Tue, 15 Nov 2016 22:25:16 GMT

rex doesn't make assignments. The 'field' keyword is literally "field"; replace 'myField' with the name of the field you want to extract from. So your query becomes

sourcetype=proxy github.com cs_uri_path!=/ cs_uri_path="*" |rex field=cs_uri_path "*" "\/(?<newField>[^\/]+)" |

Re: How to extract a string located between two backslashes in a field?

niketn — Fri, 18 Nov 2016 21:31:43 GMT

If following is your data you can use split and mvindex commands in conjunction to split based on backslash and then read first value:
fieldName="/Erginn008/3e2ce24a277ggh9/e709d1a.json"

Your Base Search Here | eval SplitFields=split(fieldName,"/") | eval firstField=mvindex(SplitFields,1)| table fieldName, SplitFields, firstField

As split command splits fieldName to multivalue field SplitFields, you need to call mvindex command to fetch the first value.

Re: How to extract a string located between two backslashes in a field?

sundareshr — Sat, 19 Nov 2016 00:12:59 GMT

Try this

sourcetype=proxy github.com cs_uri_path!=/ cs_uri_path=* | rex field=cs_uri_path "\/(?<path>[^\/]+?)\/" |

Re: How to extract a string located between two backslashes in a field?

aaraneta_splunk — Wed, 30 Nov 2016 04:20:42 GMT

@marktechuk - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.