Splunk Dev

need rex to fetch string between []

rkishoreqa
Communicator

I need to fetch the value 'app_mot_auto_toyota_cars_SOA' from the below string.  I tried with the rex - rex field=_raw "[INFO ]\s[(?P<Applname>)]\s+".   But it is not working. 

Can anyone please help me with the regex expression.

> [INFO ] [app_mot_auto_toyota_cars_SOA]

0 Karma
1 Solution

saravanan90
Contributor

This may help..

|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?<Applname>\S+)]"

View solution in original post

saravanan90
Contributor

This may help..

|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?<Applname>\S+)]"

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...