All Apps and Add-ons

can i select field between brackets [ XYZ - ABC - ] using regular expression?

royimad
Builder

I need to select fields from a log who are between two [ ]
Event 1: Some data... [ AAA ]
Event 2: Some data... [aa - DD ]

I need those fields
AAA
aa - DD
DD

How to do that? I'm using this regular expression (?P[^ ]+) but the extraction is incorrect it extract

[AAA

[aa
and this is wrong i don't need the first character [ and need to get all the data between [ ]

0 Karma
1 Solution

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

View solution in original post

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

jonuwz
Influencer

Converted to answer - this is correct, and well explained : )

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...