topic Feedback on regex on a single string in Splunk Search

Feedback on regex on a single string

smhsplunk — Tue, 29 Sep 2020 11:30:03 GMT

I am trying to regex to get a substring
I want substring "addressON" from this string "ThisStreet_addressON_blockb"

here is my query

host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>)\_blockb$" | table thisStreet

This is not working

Re: Feedback on regex on a single string

skoelpin — Wed, 19 Oct 2016 16:07:03 GMT

Try this

| rex (?P<thisStreet>_(\w+)_)

Re: Feedback on regex on a single string

gcusello — Wed, 19 Oct 2016 16:11:46 GMT

You forgot the format of your regex:

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>[^ ]*)\_blockb$" | table thisStreet

in this way you take all chars but no spaces between the underscores.

Eventually try a different one on https://regex101.com/

Bye.
Giuseppe

Re: Feedback on regex on a single string

somesoni2 — Wed, 19 Oct 2016 16:16:25 GMT

You're almost there. Your name search is missing the capturing regex. Try this

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet

Alternative, try this

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet

Re: Feedback on regex on a single string

smhsplunk — Wed, 19 Oct 2016 17:18:56 GMT

For some weird reason only mvindex worked! Thanks!

Re: Feedback on regex on a single string

somesoni2 — Tue, 29 Sep 2020 11:30:10 GMT

The other two methods rely on actual string available before and after the thisStreet that you're trying to extract. The regex in 1st and 3rd option is assuming you have a literal string "ThisStreet_" before and "_blockb" after. If they are not static/literal string, then try like this:-

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "[^_]+_(?<thisStreet>[^_]+)_.+$" | table thisStreet