Dashboards & Visualizations

How to write a rex for an alphanumeric field extraction

av_
Path Finder

Need help with the extraction of an alpha numeric field. E.G. : ea37c31d-f4df-48ab-b0b7-276ade5c5312

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use a character class - it looks like this is hexadecimal with some hyphens thrown in so try

[a-f0-9-]
0 Karma

av_
Path Finder

Thanks @ITWhisperer . 
[^\"] worked for me.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as that probably seems to be UUID string, you could make more strict regex to match it like

[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

Time by time your data could contains some data which could match e.g. [^\"]+ but it's still e.g. UUID.

Also those regex use different amount of resources. With only some events this is usually not an issue, but if/when you have e.g. billions of events then even 1ms start to make difference. You could look that e.g. with regex101.com. 

This happened quite often e.g. with SSN + bank accounts etc. So look your data and use expression which match best for your data!

r. Ismo 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Cool - you obviously have more (unshared) knowledge about your events, which I could not easily have guessed at!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...