topic Re: How to extract all fields between a word and two specific characters in a string? in Splunk Search

How to extract all fields between a word and two specific characters in a string?

royimad — Fri, 20 May 2016 12:04:46 GMT

I have a text as following:

Hello OFF anything blah blah & ^ anything -   )<  OFF anything blo blo & ^ ble -  )< OFF  anything bli bli & ^ ble -  )<

I need to extract all the fields that start with OFF and end with 2 characters )<
In my case, 3 fields need to be extracted.

I wrote a search, but it's only extracting the first occurrence while I want to extract all the fields

 sourcetype=imap OFF | rex field=_raw "OFF (?<myfields>.*?)\)\<"

Re: How to extract all fields between a word and two specific characters in a string?

jkat54 — Fri, 20 May 2016 12:15:46 GMT

How about this?

  rex "(?ms)(?<=OFF )(?<myFields>.*)(?=\)\>)"

If that doesn't work, try it without (?ms).

Re: How to extract all fields between a word and two specific characters in a string?

jkat54 — Fri, 20 May 2016 12:18:07 GMT

You might also have to break the source data into one event per line.

Re: How to extract all fields between a word and two specific characters in a string?

royimad — Fri, 20 May 2016 12:35:57 GMT

Your regular expression select the field started by OFF and ended with )< into one field but it did not split it into 3 fields , i can't break the source data into one event per line ( its an email while i'm trying to decode )

Re: How to extract all fields between a word and two specific characters in a string?

royimad — Fri, 20 May 2016 12:38:00 GMT

I also try it without ms ( the result is the same, one field was selected as following:
Field started with the first concurrence of OFF and ending with the last occurrence of )>

Re: How to extract all fields between a word and two specific characters in a string?

jkat54 — Fri, 20 May 2016 13:07:42 GMT

Did it split the desired fields by spaces but into just one field?

Re: How to extract all fields between a word and two specific characters in a string?

sundareshr — Fri, 20 May 2016 13:08:31 GMT

This should work (use only the rex command segment)

| gentimes start=-1 | eval _raw="Hello OFF anything blah blah & ^ anything - )< OFF anything blo blo & ^ ble - )< OFF anything bli bli & ^ ble - )<" | rex max_match=0 field=_raw "OFF\s(?<field>[^\)]+)" | table field

Re: How to extract all fields between a word and two specific characters in a string?

jkat54 — Fri, 20 May 2016 13:17:44 GMT

If so we can fix it from there.

Re: How to extract all fields between a word and two specific characters in a string?

royimad — Tue, 31 May 2016 07:16:21 GMT

Thanks you.