Splunk Search

Can you help me build a regex that can extract a field from the following event?

jip31
Motivator

Hello

I want to extract the field below from my event

ABDM-TOUPDATE.$w$

could you help me please?

0 Karma
1 Solution

inventsekar
Super Champion

Pls check this run-anywhere example -
(please provide some logs and more details, so that exact rex query can be written -)

| makeresults 
| eval _raw = "something something ABDM-TOUPDATE.5w2 something something"
| rex field=_raw "(?P<rexHELP>ABDM-TOUPDATE\.\d\w\d)"
| table _raw rexHELP

alt text

>>> Happy Splunking !

View solution in original post

0 Karma

inventsekar
Super Champion

Pls check this run-anywhere example -
(please provide some logs and more details, so that exact rex query can be written -)

| makeresults 
| eval _raw = "something something ABDM-TOUPDATE.5w2 something something"
| rex field=_raw "(?P<rexHELP>ABDM-TOUPDATE\.\d\w\d)"
| table _raw rexHELP

alt text

>>> Happy Splunking !
0 Karma

493669
Super Champion

could you please share what needs to be extracted and whats your raw event?

0 Karma

jip31
Motivator

I cant sent the raw event because confidentiality
in my event, i just want to extract this: ABDM-TOUPDATE.$w$

0 Karma

FrankVl
Ultra Champion

Just that literal string? Or are those $ signs placeholders of something?

And what do you want to extract it from and where do you want to extract it into?

Simple example extracting from _raw into field1: | rex field=_raw "(?<field1>ABDM-TOUPDATE\.\$w\$)"

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>