Splunk Search
Highlighted

Can someone help me with Regex or rex command?

Explorer

I have a field name called Column1 with the following data below...

Data1: |Transitioned to:Team1|Transition Reason:Out of Scope|handledbySomeone3|
Data2: |Transitioned to:Team2|Transition Reason:Invalid Description|handledbySomeone2|
Data3: |Transitioned to:Team3|Transition Reason:Incomplete Details|handledbySomeone1|

I just need to extract the values of Transition Reason e.i. Out of Scope, Invalid Description and Incomplete Details, however I couldn't come up with the correct regex query. Can someone help me how to or what is the exact query?

Query I currently have is: index=sampleIndex1| rex field=Column1 "\bTransition Reason:\K.+?(?=|)" | table Column1

Tags (3)
0 Karma
Highlighted

Re: Can someone help me with Regex or rex command?

Legend

Hi trem0re09,
try something like this

| rex field=Column1 "\|Transition Reason:(?<Transiction_Reason>[^\|]*)\|"

you can test it at https://regex101.com/r/I1Hgk4/1

Bye.
Giuseppe

View solution in original post

Highlighted

Re: Can someone help me with Regex or rex command?

Explorer

Thanks for helping me out! 🙂

0 Karma
Highlighted

Re: Can someone help me with Regex or rex command?

Legend

If this answer solve your problem, please, accept and7or upvote it.
Bye, see next time.
Giuseppe

0 Karma
Highlighted

Re: Can someone help me with Regex or rex command?

SplunkTrust
SplunkTrust

There is no "exact query" as there often are many ways to do the same thing in regex. Also, if you use backticks around your SPL special characters will be preserved and we'll be able to see the regex you tried.

Try this:

index=sampleIndex1 | rex field=Column1 "Reason:(?<reason>[^\|]+)" | table Column1 reason
---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Can someone help me with Regex or rex command?

Explorer

I just realized splunk has its own syntax when it comes to regex. 🙂

Thanks for helping me out. Now it works smoothly.

0 Karma
Highlighted

Re: Can someone help me with Regex or rex command?

SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma