Regex

[Khuzair81]

Hi All,

Please help me to solve this.

desc="Trigger App : Search [Abc_[qwert] asd] number" 

I want to fetch the "[Abc_[qwert] asd]" from the above string

Thanks

[Bigslee]

try using https://regex101.com . You can test your regex statements prior to using them on splunk

[scelikok · Accepted solution]

Hi @Khuzair81,

Please try below;

| rex field=desc "(?<new_field>\[.+[^\]].*\])"

[Khuzair81]

@scelikokThankyou