Splunk Search

Extracting event using rex

HenryFitzerald
New Member

Hi ,Could anyone assist I am attempting to perform a query that extracts an event in splunk
"fd-credit-darc-quotations--gb-hbeu" which is part of a longer string below/

<14>1 2018-07-24T18:34:42.81641+00:00 **whjc100-digital-fet-platform-prd.prod.fd-credit-darc-quotations--gb-hbeu**-1-0-1-20180626161234pred.prd.

I tried using below but it extracts everything starting from fd-credit card but does not stop at --gb-hbeu =>
| rex field=_raw "whjc100-digital-fet-platform-prd.prod.(?.[a-zA-Z0-9]{4}$)"

Could anyone help,Thanks

Tags (2)
0 Karma

PowerPacked
Builder

Hi

Give this a try

alt text

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@HenryFitzerald Rather than pile on to a three-year-old question with an accepted answer, you should ask a new question describing your problem. I did it for you this time. 😉

---
If this reply helps you, Karma would be appreciated.
0 Karma

HenryFitzerald
New Member

Thanks RichGalloway,much appreciated

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...