Splunk Search

Extract data from a string that has variable length

madakkas
Explorer

Hi I have the below data , and am trying to extract the below

Start lsakjdf sdlkj sd CODE=CODE1 ksdjf ksajfd sakjdf
Start $jdf$ ssfjdlkj sd CODE=CODE2 ksdjf ksajfd sakjdf
Start lsakjdf CODE=CODE3 ksdjf ksajfd sakjdf
Start lsakj44 sdlkj sdah sd CODE=CODE4 ksdjf ksajfd sakjdf

CODE=CODE1
CODE=CODE2
CODE=CODE3
CODE=CODE4

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Did you try below regex:

| rex field=_raw "(?P<data>\w+=\w+)"

View solution in original post

0 Karma

p_gurav
Champion

Did you try below regex:

| rex field=_raw "(?P<data>\w+=\w+)"
0 Karma

madakkas
Explorer

that did work ,

I set it up using the below as well

|eval CODE = trim(substr(mvindex(split(MSGTXT," "),mvfind(split(MSGTXT," "),"CODE=")),0,10))

0 Karma

damien_chillet
Builder

Are you looking for a regex? (?P<data>\w+=\w+) maybe?

0 Karma

madakkas
Explorer

I am fine with any approach as far as i get my result.

regex as well is fine.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...