Other Usage

How to create regex for AWS ARN to extract region?

chvenu17
Path Finder

Please help to create regx to extract region from below aws ARN(us-west-2)

arn:aws:secretsmanager:us-west-2:1111111111:secret:/rds-oracle/xxxx-xx17sd-xxxxxx-xxx67xxx7gd7133/TEST-01TEST

Labels (1)
Tags (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

...
| rex "^(?:\w+:){3}(?<region>[^:]+)"

this should do the extraction. If the ARN is on field, then you should add “field=<field name>” in rex.

r. Ismo

View solution in original post

chvenu17
Path Finder

Thank you , its working 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

...
| rex "^(?:\w+:){3}(?<region>[^:]+)"

this should do the extraction. If the ARN is on field, then you should add “field=<field name>” in rex.

r. Ismo

chvenu17
Path Finder

Can you help to brekdown, in case i want to modify to pull different field

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Here is a link https://regex101.com/r/GVLrA1/1 where you could read what those are meaning. There is also easy to chain it.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...