topic Re: How to extract substring from a string in Splunk Search

How to extract substring from a string

bagarwal — Thu, 13 Jul 2017 04:32:31 GMT

Hi Everyone,
I have a string field that contains similar values as given below:

String = This is the string (generic:ggmail.com)(3245612)
= This is the string (generic:abcdexadsfsdf.cc)(1232143)

I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that.

Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com)

May need to use regex. If someone can help me out, Thanks in advance.

Regards,
Binay

Re: How to extract substring from a string

niketn — Thu, 13 Jul 2017 06:13:00 GMT

You can try the following (this is very generic high leve regular expression which you might need to tweak based on your actual sample data):

| rex field=_raw "\(generic:(?<myField>[^\)].*)\)\("
| table _raw myField

Test out your regular expression on regex101.com with more sample data.
Also it is better if you create Field through Interactive Field Extraction (IFX), so that Splunk creates regular expression automatically based on sample data. Field Extraction Knowledge Object will serve better with re-usability and easy maintenance.

Step by Step documentation link : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Re: How to extract substring from a string

gcusello — Thu, 13 Jul 2017 06:43:31 GMT

try with something like this

\(generic:(?<Field>[^\)]*)\)\(

test it at https://regex101.com/r/2VG31q/1
Bye.
Giuseppe

Re: How to extract substring from a string

bagarwal — Fri, 14 Jul 2017 04:38:47 GMT

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂