Splunk Enterprise

What regex can extract everything up to a specific character?

Steve_A200
Path Finder

Hi,

I need assistance with writing a regex that extracts all characters upto the character "_" underscore.

so, the data could look like this:

field1:

ABCD_1234234
EFG_12349879
HIJK_12349850

And I would like to only see:

ABCD
EFG
HIJK

I tired this however it is not doing the trick:


| regex field1 = "^.*?(?=\_)"

regex101 seems to show it working but ... I must be missing something when converting it into splunk.

Any help would be appreciated.

Thanks,

Labels (2)
0 Karma
1 Solution

abi2023
Path Finder

basesearch | rex field=field1 "^(?<field2>[^_]+)_" 

View solution in original post

abi2023
Path Finder

basesearch | rex field=field1 "^(?<field2>[^_]+)_" 

Steve_A200
Path Finder

Thank you, that worked exactly how I needed it to work.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...