Solved: help with field extraction

chauble · ‎05-20-2013

I have a log with the following types of entries.. I would like to extract the information between the single quotes into a field.. any insight would be appreciated

WARN The filing operation with containment name 'Missed Payment Second Letter Xen418' is experiencing high numbers of uniqueness violations

WARN The filing operation with containment name 'Changing Your Child Support Order Xen261' is experiencing high numbers of uniqueness violations

WARN The filing operation with containment name 'Transfer Letter, Universal Xenn351A-B, Xen351SPA, Xen351SOM' is experiencing high numbers of uniqueness violations

carasso · ‎05-20-2013

use rex or make a saved field extraction. this regex extracts anything between two single quotes...

... | rex "'(?<my_quoted_field>[^']*)'"

View solution in original post

carasso · ‎05-20-2013

use rex or make a saved field extraction. this regex extracts anything between two single quotes...

... | rex "'(?<my_quoted_field>[^']*)'"

help with field extraction

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation