Solved: help with field extraction

chauble · ‎05-20-2013

I have a log with the following types of entries.. I would like to extract the information between the single quotes into a field.. any insight would be appreciated

WARN The filing operation with containment name 'Missed Payment Second Letter Xen418' is experiencing high numbers of uniqueness violations

WARN The filing operation with containment name 'Changing Your Child Support Order Xen261' is experiencing high numbers of uniqueness violations

WARN The filing operation with containment name 'Transfer Letter, Universal Xenn351A-B, Xen351SPA, Xen351SOM' is experiencing high numbers of uniqueness violations

carasso · ‎05-20-2013

use rex or make a saved field extraction. this regex extracts anything between two single quotes...

... | rex "'(?<my_quoted_field>[^']*)'"

View solution in original post

carasso · ‎05-20-2013

use rex or make a saved field extraction. this regex extracts anything between two single quotes...

... | rex "'(?<my_quoted_field>[^']*)'"

help with field extraction

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation