All Apps and Add-ons

can i select field between brackets [ XYZ - ABC - ] using regular expression?

royimad
Builder

I need to select fields from a log who are between two [ ]
Event 1: Some data... [ AAA ]
Event 2: Some data... [aa - DD ]

I need those fields
AAA
aa - DD
DD

How to do that? I'm using this regular expression (?P[^ ]+) but the extraction is incorrect it extract

[AAA

[aa
and this is wrong i don't need the first character [ and need to get all the data between [ ]

0 Karma
1 Solution

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

View solution in original post

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

jonuwz
Influencer

Converted to answer - this is correct, and well explained : )

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...