Splunk Search

Extract string using rex

RVDowning
Contributor

I have data that looks like:
20140609 19:14:03 [PERF] [CREATE PLAN START] Action=CreatePlan,
and would like to extract the text between the second pair of brackets, namely in the above line the text "CREATE PLAN START."

I tried rex field=_raw "]s+[=(?[]])" but obviously this isn't right.

Tags (2)
0 Karma
1 Solution

RVDowning
Contributor

Finally got it right:

rex field=_raw "] [(?.+?)]"

View solution in original post

RVDowning
Contributor

Finally got it right:

rex field=_raw "] [(?.+?)]"

aweitzman
Motivator

This looks like it might work for you:

rex field=_raw "]\s+\[(?<step>[\w\s]*)\]"

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...