Reporting

Regex - Cannot extract terms with spaces

POR160893
Builder

Hi,

I am using the following rex command to extract all text in between "....device-group:" and "succeeded ...." for a field called "old" and assigning the extracting values to a new field called "new".

| rex field=old "device-group:\s*(?<new>\S+)"

Currently, it is extracting all text in between "....device-group:" and "succeeded ...." EXCEPT for cases where there are multiple words with spaces.

Examples include:

1) "Panorama push to device:013101009509 for device-group: Austin Cloud DMZ succeeded. JobId=2484595" where the extracted values should be "Austin Cloud DMZ "

2) "Panorama push to device:013101014290 for device-group: Austin Bank Segmentation succeeded. JobId=2482583" where the extracted values should be "Austin Bank Segmentation"


Can you please help on extracting  such cases too?

Thank you!

Labels (1)
0 Karma
1 Solution

POR160893
Builder

Solved it myself actually: | rex field=body "device-group:\s*(?<deviceGroup>.+?) succeeded"

View solution in original post

0 Karma

POR160893
Builder

Solved it myself actually: | rex field=body "device-group:\s*(?<deviceGroup>.+?) succeeded"

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...