topic Re: RegEx Extraction Assistance for new field. in Splunk Search

RegEx Extraction Assistance for new field.

matt4321 — Thu, 12 Apr 2018 20:23:09 GMT

I have a field that looks like the below.

PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)

Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)

I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"

PMGroup=Build VZT
PMGroup=Run

Any help would be appreciated.

Re: RegEx Extraction Assistance for new field.

niketn — Thu, 12 Apr 2018 20:30:54 GMT

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

Re: RegEx Extraction Assistance for new field.

matt4321 — Thu, 12 Apr 2018 21:02:58 GMT

This worked perfect but for some reason I had to add field=PM for it to extract properly.

| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

Re: RegEx Extraction Assistance for new field.

niketn — Fri, 13 Apr 2018 05:44:20 GMT

Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.