Field Extraction. Excluding a single word.

[fvasquezchacon]

Hi!

I wolud like make a extraction using the field extractor app. My question is how to exclude a single word of the extraction since it has variable word length (between 2 and 3 words).

This is my comand:

(?i)RESULT: (?\w*\s*\w*\s*\w*)

If the extractor finds the word "MIN" in the third word place, I don't want to extract it and keep it with the first two words.

Thanks in advance!

[fvasquezchacon]

Thanks a lot for your answers! It helped me to solve the issue. And as posted, the form removed the back slashes (and also less-than and greater-than signs).

What I have done is the following regex:

(?m)RESULT: (?P"less-than sign"FIELD_NAME"greater-than sign".+?)$

[adauria_splunk]

First, you could try a regex that looks for either spaces followed by a number or MIN as the end, outside the capture group, like this maybe:

RESULT: (.*)(\s+MIN|\s+\d)

If that doesn't work, you could pipe it to an eval statement that uses the rtrim function to remove MIN, then eval with rtrim again to remove the last space.

[adauria_splunk]

The form removed the back slashes before the s and d, above...you'll need those

[fvasquezchacon · Accepted solution]

Hi!

Here is a simple (2 events). It's a multiline event data. What I 'm looking for is to extract the sentence after the word "RESULT: ". The sentence can have 2 or three words.

MACUL      ALT103 SEP14 00:02:28 5971 FAIL ALT 
        MAIP 02 0 04 01    DN 229525843    1st CYCLE
        LIT TESTS= R-G T-G FEMF  RESULT: RING DC FEMF
        MAX      2 VOLTS  ACT      8 VOLTS

MACUL      ALT104 SEP14 00:38:56 0576 FAIL ALT 
        GOBE 00 0 11 20    DN 229444877    1st CYCLE
        LIT TESTS= R-G T-G FEMF  RESULT: TIP  LEAKAGE
        MIN    40000 OHMS   ACT      000 OHMS

[somesoni2]

How about this

Your base search | rex "(?i)RESULT:(?.*)"

[jeremiahc4]

Can you post a sample of the event data?