Splunk Search

Extract data from a string that has variable length

madakkas
Explorer

Hi I have the below data , and am trying to extract the below

Start lsakjdf sdlkj sd CODE=CODE1 ksdjf ksajfd sakjdf
Start $jdf$ ssfjdlkj sd CODE=CODE2 ksdjf ksajfd sakjdf
Start lsakjdf CODE=CODE3 ksdjf ksajfd sakjdf
Start lsakj44 sdlkj sdah sd CODE=CODE4 ksdjf ksajfd sakjdf

CODE=CODE1
CODE=CODE2
CODE=CODE3
CODE=CODE4

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Did you try below regex:

| rex field=_raw "(?P<data>\w+=\w+)"

View solution in original post

0 Karma

p_gurav
Champion

Did you try below regex:

| rex field=_raw "(?P<data>\w+=\w+)"
0 Karma

madakkas
Explorer

that did work ,

I set it up using the below as well

|eval CODE = trim(substr(mvindex(split(MSGTXT," "),mvfind(split(MSGTXT," "),"CODE=")),0,10))

0 Karma

damien_chillet
Builder

Are you looking for a regex? (?P<data>\w+=\w+) maybe?

0 Karma

madakkas
Explorer

I am fine with any approach as far as i get my result.

regex as well is fine.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...