topic Re: Extract data from a string that has variable length in Splunk Search

Extract data from a string that has variable length

madakkas — Thu, 12 Apr 2018 06:02:52 GMT

Hi I have the below data , and am trying to extract the below

Start lsakjdf sdlkj sd CODE=CODE1 ksdjf ksajfd sakjdf
Start $jdf$ ssfjdlkj sd CODE=CODE2 ksdjf ksajfd sakjdf
Start lsakjdf CODE=CODE3 ksdjf ksajfd sakjdf
Start lsakj44 sdlkj sdah sd CODE=CODE4 ksdjf ksajfd sakjdf

CODE=CODE1
CODE=CODE2
CODE=CODE3
CODE=CODE4

Re: Extract data from a string that has variable length

damien_chillet — Thu, 12 Apr 2018 12:21:14 GMT

Are you looking for a regex? (?P<data>\w+=\w+) maybe?

Re: Extract data from a string that has variable length

madakkas — Thu, 19 Apr 2018 03:50:07 GMT

I am fine with any approach as far as i get my result.

regex as well is fine.

Re: Extract data from a string that has variable length

p_gurav — Thu, 19 Apr 2018 04:16:19 GMT

Did you try below regex:

| rex field=_raw "(?P<data>\w+=\w+)"

Re: Extract data from a string that has variable length

madakkas — Wed, 25 Apr 2018 03:17:41 GMT

that did work ,

I set it up using the below as well

|eval CODE = trim(substr(mvindex(split(MSGTXT," "),mvfind(split(MSGTXT," "),"CODE=")),0,10))