Splunk Search

Extract the words after Result=xxx

Satcom9
Engager

ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found

I want to extract the words that come after Result=XXX And not include the Result=xxx in the output.

|rex field=Message "(?<Test>\bResult.*\D+)"   This produces this output>>> Result=110 No Insertion Channel Found.

 

So I want to exclude the Results=XXX 

 

Labels (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi @Satcom9 

Pls check this(just a little tweak of your rex):

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=110(?<Test>\D+)" | table Message Test

but the 110 should not hard-coded.. try this instead. thanks. 

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=\d\d\d\s(?<Test>.*)" | table Message Test

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Satcom9 

Pls check this(just a little tweak of your rex):

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=110(?<Test>\D+)" | table Message Test

but the 110 should not hard-coded.. try this instead. thanks. 

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=\d\d\d\s(?<Test>.*)" | table Message Test

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

Satcom9
Engager
|rex field=Message "Result=\d\d\d\s(?<Test>.*)"

 

I replaced yours with mine and it works perfectly for what I was looking for, TY for the response.

Satcom9_0-1725411986818.png

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...