- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Extract a string from a field using regex.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hi All,
I am having an issue on extracting a string in a field. For example, I have this data below:
"18/10/2018 03:44:35 - Joneil Englis (Additional comments) Hi All, this is now being investigated. We'll keep you updated on our progress. 16/10/2018 04:40:51 - David Jinn Hong Chia (Additional comments) Hi team Another Shipment Cost Document has the same issue in E1P today. 563638 15/10/2018 02:21:06 - Christian Espinosa (Additional comments) Hi All, this is now being investigated. We'll keep you updated on our progress. "
I need to get the latest name on who updated the ticket. I am trying to use a regex expression where i can get the string between the character "-" and "(" but sometimes the data of the field contains many occurrence of these characters.
I need to get the string Joneil Englis. Could anyone help me?
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
If the latest occurrence is always at the start, it is fairly straightforward:
^"\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+-\s+(?<name>[^\(]+)\s+\(
https://regex101.com/r/70N4wf/1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
If the latest occurrence is always at the start, it is fairly straightforward:
^"\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+-\s+(?<name>[^\(]+)\s+\(
https://regex101.com/r/70N4wf/1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Thanks Frank!
It works now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
I modified the regex a little so that it will take less steps to find the match.
This is the regex: ^"[\d\/\s\:]+-\s+(?<name>[\w\s]+)
https://regex101.com/r/70N4wf/3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Dangerous assumption that names don't contain anything but alphanumeric and spaces. Also, yours captures the trailing space behind the name (not sure if Splunk will automatically trim that perhaps?).
But the part before the name is indeed more efficient like this, thanks 🙂
