I have a field name called Column1 with the following data below...
Data1: |Transitioned to:Team1|Transition Reason:Out of Scope|handledbySomeone3|
Data2: |Transitioned to:Team2|Transition Reason:Invalid Description|handledbySomeone2|
Data3: |Transitioned to:Team3|Transition Reason:Incomplete Details|handledbySomeone1|
I just need to extract the values of Transition Reason e.i. Out of Scope, Invalid Description and Incomplete Details, however I couldn't come up with the correct regex query. Can someone help me how to or what is the exact query?
Query I currently have is: index=sampleIndex1| rex field=Column1 "\bTransition Reason:\K.+?(?=|)" | table Column1
There is no "exact query" as there often are many ways to do the same thing in regex. Also, if you use backticks around your SPL special characters will be preserved and we'll be able to see the regex you tried.
index=sampleIndex1 | rex field=Column1 "Reason:(?<reason>[^\|]+)" | table Column1 reason
I just realized splunk has its own syntax when it comes to regex. 🙂
Thanks for helping me out. Now it works smoothly.
If your problem is resolved, please accept an answer to help future readers.