Splunk Search

Can you help me create a regex expression that captures text with a comma?

JoshuaJohn
Contributor

I have this log:

2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30

I am trying to capture "9/20/2018 4:43". The characters "MDM," will always be there before the date/time. It will also always end with a comma.

Any ideas?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You have not said whether or not you need to get this data at search time or index time, so I'm going to assume search time (since that is Splunk Best Practice. Here is a run anywhere search that shows how you can do the field extraction. I leave it up to you to decide how you will implement the regular expression, whether it be in an automatic field extraction, or done as an inline search:

| makeresults
| eval data="2139,A-1112,74,01:11:71:E1:A1:C1,store,store@store.net,Nitro,Enroll,nitrofire Enroll,,Windows ,Redblue - B111.B4321,,C,1.1.3213,5/4/2018 7:23,Compliant,Enrolled,,MDM,9/20/2018 4:43,,No ,N/A,United States,Yes,00000000A6C344A354543534535345CEBD4A928D,000-88,,No,3/9/2018 17:38,9/20/2018 4:30"
| rex field=data "MDM,(?<datefield>[^,]*),"

The rex portion is the only part that you would really need to be concerned with from the above search, as it gives you the regular expression that you need.

0 Karma

hcheang
Path Finder

Try

| rex "MDM,(?<tmp>[^,]+),"
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...