Splunk Enterprise

What regex can extract everything up to a specific character?

Steve_A200
Path Finder

Hi,

I need assistance with writing a regex that extracts all characters upto the character "_" underscore.

so, the data could look like this:

field1:

ABCD_1234234
EFG_12349879
HIJK_12349850

And I would like to only see:

ABCD
EFG
HIJK

I tired this however it is not doing the trick:


| regex field1 = "^.*?(?=\_)"

regex101 seems to show it working but ... I must be missing something when converting it into splunk.

Any help would be appreciated.

Thanks,

Labels (2)
0 Karma
1 Solution

abi2023
Path Finder

basesearch | rex field=field1 "^(?<field2>[^_]+)_" 

View solution in original post

abi2023
Path Finder

basesearch | rex field=field1 "^(?<field2>[^_]+)_" 

Steve_A200
Path Finder

Thank you, that worked exactly how I needed it to work.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...