Splunk Search

Extract a string

rbachu1
Explorer

Hi everyone, I have the below string.

isadhakdahdj asdh, hosadhao activity=Follow Up, entryName=Initial Outreach, asasa adadad oidaoidadalnd.

I want to extract .

activity=Follow Up

entryName=Initial Outreach

activity & entryName are static, but value of that may be dyna

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "activity=(?<activity>[^,]+),\sentryName=(?<entryName>[^,]+),"

View solution in original post

0 Karma

rbachu1
Explorer

Thank you so much, exactly what I needed.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "activity=(?<activity>[^,]+),\sentryName=(?<entryName>[^,]+),"
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...