Splunk Search

Can you help me with my regex expression?

pench2k19
Explorer

Hi Team,

I'm struggling to get the regex expression for the following values. I want to capture the text before the first _ symbol into one field and after the _symbol value into another field. I need a common expression that works for all.

broadridge_endur_exch_trades_parent
1end_endur_exch_trades_parent
1end_endur_comp_trades_parent
1img_img_gl_000
1img_gl
1gmi_GNACMFF1
1lst_agr_trd
epx_epx_afs_file
fxcal_balance_report

I am using the following expression, but it's not working

rex field=Datafeed_name "^(?\w{3,10})_(?\w+)$"

Can you please help?

@vnravikumar @jakt54

0 Karma
1 Solution

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

View solution in original post

0 Karma

FrankVl
Ultra Champion

\w includes _, that is where your attempt fails.

Try this; "^(?<field1>[^_]+)_(?<field2>\w+)$"

https://regex101.com/r/y5JIIB/1

0 Karma

pench2k19
Explorer

thanks for the quick turn around mate...will check and confirm

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...