Splunk Enterprise

Regex to capture below format data

Ashwini008
Builder

Hi ,

please help me with regex expression to capture the data in below part which is in bold and underlined.

e+o.in_zpiystoc.stkdrtyini.600.1.txt.1.yyyymmddhhmmss
e+o.drlugrbuyhe.xml.1.yyyymmddhhmmss
k+d.zpiyxery.npoudatri.600.gpg.1.20210127014546.gpg
 
i need to ignore the starting x+y values and capture only the data present before dateformat and ignore everything after date(including date).
Tags (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Ashwini008,

Please try below;

| rex "\.(?<filename>.+)\.\d{14}"
If this reply helps you an upvote and "Accept as Solution" is appreciated.

manjunathmeti
Champion

Try this:

| rex \.(?<filename>.+\.\w+\.1)
0 Karma

Ashwini008
Builder

@manjunathmeti This isn't applied to my other format files like below

c+d.zptumike.ccapd1fo.600.2.20210127020002.gpg

e+0.in_zpiyintl.truntaxi.600.1.txt.5.20210127020002.gpg

 

 

can you help with regex which applies to all the mentioned format?

 

 

0 Karma

manjunathmeti
Champion

Try this:

| rex "\.(?<filename>.+\.\w+\.\d)\."
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...