Splunk Search

Can you help me with my regex expression?

pench2k19
Explorer

Hi Team,

I'm struggling to get the regex expression for the following values. I want to capture the text before the first _ symbol into one field and after the _symbol value into another field. I need a common expression that works for all.

broadridge_endur_exch_trades_parent
1end_endur_exch_trades_parent
1end_endur_comp_trades_parent
1img_img_gl_000
1img_gl
1gmi_GNACMFF1
1lst_agr_trd
epx_epx_afs_file
fxcal_balance_report

I am using the following expression, but it's not working

rex field=Datafeed_name "^(?\w{3,10})_(?\w+)$"

Can you please help?

@vnravikumar @jakt54

0 Karma
1 Solution

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

View solution in original post

0 Karma

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

0 Karma

pench2k19
Explorer

thanks for the quick turn around mate...will check and confirm

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...