Splunk Search

Can you help me create a regex expression that captures text with a comma?

JoshuaJohn
Contributor

I have this log:

2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30

I am trying to capture "9/20/2018 4:43". The characters "MDM," will always be there before the date/time. It will also always end with a comma.

Any ideas?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You have not said whether or not you need to get this data at search time or index time, so I'm going to assume search time (since that is Splunk Best Practice. Here is a run anywhere search that shows how you can do the field extraction. I leave it up to you to decide how you will implement the regular expression, whether it be in an automatic field extraction, or done as an inline search:

| makeresults
| eval data="2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30"
| rex field=data "MDM,(?<datefield>[^,]*),"

The rex portion is the only part that you would really need to be concerned with from the above search, as it gives you the regular expression that you need.

0 Karma

hcheang
Path Finder

Try

| rex "MDM,(?<tmp>[^,]+),"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...