Splunk Enterprise

What rex command extracts data from csv?

Ashwini008
Builder

Hi,

I am trying to extract data from one of the column in lookup file. Regex expression is working in rex tool. I want to use that regex expression in rex command in splunk .

Rexgex expression  ^.*(?= \[)

Example: Want to extract the highlighted bold data. This data is present in csv lookup file.

  1. TAX PLATFORM [12998]
  2. CPOI [0639]

 

| inputlookup Meta.csv 
| rex field=Application "^.*(?<name>= \[)"

 


 

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I left the '=' in unnecessarily - try this

| inputlookup Meta.csv 
| rex field=Application "^(?<name>.*) \["

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup Meta.csv 
| rex field=Application "^(?<name>.*)= \["
0 Karma

Ashwini008
Builder

@ITWhisperer It isn't working

Ashwini008_0-1679654470813.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I left the '=' in unnecessarily - try this

| inputlookup Meta.csv 
| rex field=Application "^(?<name>.*) \["
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...