topic Re: What is the regular expression to extract "a1234567" from my event? in Splunk Search

What is the regular expression to extract "a1234567" from my event?

sravankaripe — Mon, 06 Feb 2017 15:03:50 GMT

Please help me with regular expression
i want to extract a1234567

"INDV=1234566|RSPAR|a1234567|RSPAR"

gcusello — Mon, 06 Feb 2017 15:09:29 GMT

hi sravankaripe,
you can use it on row events

\d+\|\w+\|(?<your_field>[^\|]*)

or using a rex command

| rex field=INDV "\d+\|\w+\|(?<your_field>[^\|]*)"

Bye.
Giuseppe

twinspop — Mon, 06 Feb 2017 15:12:55 GMT

I would consider using the split and mvindex commands for this, assuming INDV is being extracted already:

... | eval my_field=mvindex(split(INDV,"|"),2)

With regex:

... | rex field=INDV "RSPAR\|(?[^|]+)"

But that really depends on the consistency of the data around your target extraction.

sravankaripe — Mon, 06 Feb 2017 15:12:59 GMT

| rex field=_raw "\d+|\w+|(?[^|]*)"
this worked for me Thanks