Splunk Search

Could someone help me with this regex?

Italy1358
Path Finder

Can someone help me pull out these data points:

cw.pptx;text.html;text.txt

I need it to split at the ; mark but have them in their own fields so I can only see the .txt in my search.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Italy1358,

the best approach is that you folow the guided ield extraction using the delimited fields option.

If instead you want to use a regex, you can try this:

| rex "^(?<field1>[^;]+);(?<field2>[^;]+);(?<field3>[^;]+)"

that you can test at https://regex101.com/r/9DI2ED/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Italy1358,

the best approach is that you folow the guided ield extraction using the delimited fields option.

If instead you want to use a regex, you can try this:

| rex "^(?<field1>[^;]+);(?<field2>[^;]+);(?<field3>[^;]+)"

that you can test at https://regex101.com/r/9DI2ED/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...