Can someone help me with Regex or rex command?

[trem0re09]

I have a field name called Column1 with the following data below...

Data1: |Transitioned to:Team1|Transition Reason:Out of Scope|handledbySomeone3|
Data2: |Transitioned to:Team2|Transition Reason:Invalid Description|handledbySomeone2|
Data3: |Transitioned to:Team3|Transition Reason:Incomplete Details|handledbySomeone1|

I just need to extract the values of Transition Reason e.i. Out of Scope, Invalid Description and Incomplete Details, however I couldn't come up with the correct regex query. Can someone help me how to or what is the exact query?

Query I currently have is: index=sampleIndex1| rex field=Column1 "\bTransition Reason:\K.+?(?=|)" | table Column1

[richgalloway]

There is no "exact query" as there often are many ways to do the same thing in regex. Also, if you use backticks around your SPL special characters will be preserved and we'll be able to see the regex you tried.

Try this:

index=sampleIndex1 | rex field=Column1 "Reason:(?<reason>[^\|]+)" | table Column1 reason

[trem0re09]

I just realized splunk has its own syntax when it comes to regex. 🙂

Thanks for helping me out. Now it works smoothly.

[richgalloway]

If your problem is resolved, please accept an answer to help future readers.

[gcusello · Accepted solution]

Hi trem0re09,
try something like this

| rex field=Column1 "\|Transition Reason:(?<Transiction_Reason>[^\|]*)\|"

you can test it at https://regex101.com/r/I1Hgk4/1

Bye.
Giuseppe

[trem0re09]

Thanks for helping me out! 🙂

[gcusello]

If this answer solve your problem, please, accept and7or upvote it.
Bye, see next time.
Giuseppe