Splunk Search

Extracting data in between unique characters

behymejt2012
Path Finder

Hi Everyone,

I am still new to Splunk and have found myself in a predicament for extracting a specific value, within a value. So for the following:

usb#android(04e8) mass storage(685e)#abc123abc123

I am trying to extract everything between # and # so essentially "android(04e8) mass storage(685e)". I have head about using regex/rex but I wasn't sure if there was an eval function that could perform this?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Why not use regex? 🙂

rex "#(?<yourfieldname>.+?)#"

View solution in original post

Ayn
Legend

Why not use regex? 🙂

rex "#(?<yourfieldname>.+?)#"

behymejt2012
Path Finder

Perfect. Was also looking at I would pull all the content from the beginning to a specific character ")". Ex from above: "android"

Also, any recommended avenues for learning this version of regex (books, articles, etc)

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...