topic Re: Regex to extract multiple fields from single event in Splunk Search

Regex to extract multiple fields from single event

gvnd — Mon, 05 Jun 2017 11:41:09 GMT

Hi, I want to extract particular fields from single event based on fields position.

Sample Data:

event1: aaa|bbb|ccc|234| | f5h | |tgvsfj| jhsfj| | | | 6384;
event2: aaa|ggg|hhh|56f| | 563 | |dhr| jhsfj| | | | 6385;

Now, I want to extract 3rd field(i.e ccc) and 7th field(i.e some spaces,nodata)

My data may include spaces.

I need regex to extract those fields only.

Thanks in advance.

Re: Regex to extract multiple fields from single event

dineshraj9 — Mon, 05 Jun 2017 11:57:25 GMT

You see each field is a set of characters which is "NOT |" followed by a "|".

| rex "([^\|]*\|){2}(?<thirdField>[^\|]*)\|([^\|]*\|){3}(?<seventhField>[^\|]*)"

Test regular expressions using https://regex101.com/r/Odnybw/1

Re: Regex to extract multiple fields from single event

inventsekar — Mon, 05 Jun 2017 12:04:08 GMT

Please check this -
sourcetype=sample | rex field=_raw "^(?:[^\|\n]*\|){2}(?P<string1>\w+)(?:[^ \n]* ){3}\|(?P<string2>\s+)" | table string1 string2 _raw