All Apps and Add-ons

can i select field between brackets [ XYZ - ABC - ] using regular expression?

royimad
Builder

I need to select fields from a log who are between two [ ]
Event 1: Some data... [ AAA ]
Event 2: Some data... [aa - DD ]

I need those fields
AAA
aa - DD
DD

How to do that? I'm using this regular expression (?P[^ ]+) but the extraction is incorrect it extract

[AAA

[aa
and this is wrong i don't need the first character [ and need to get all the data between [ ]

0 Karma
1 Solution

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

View solution in original post

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

jonuwz
Influencer

Converted to answer - this is correct, and well explained : )

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...