Security

How to extract complete string using regular expression

Nith1
Path Finder

Hi TEam

I have the below data in the logs how can i extract the complete string using regular expression . 

4678-business-release-${table.date}-292_(2) 
6789-business-release-06102021-292

I have tried using 

| rex field=_raw "deploy_release\=(?<Deploy_Release>.[^\n][a-z0-9#][^\n])" 

But i could get only the first values (i.e) 4678 and 6789 but not the completed string .Can someone please correct me 

Thanks

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Nith1 

Can you please share your expected OP from you sample event?

Meanwhile can you please try this?

| rex field=_raw "deploy_release\=(?<Deploy_Release>.[^\n].*)"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "deploy_release\=(?<Deploy_Release>.*?)" 

Can you share the full event as you might be able to do this a different way if the deploy_release field is not the remainder of the line and is delimited by a space for example

| rex field=_raw "deploy_release\=(?<Deploy_Release>[^\s]+)" 
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...