Splunk Search

Extracting field with a guid as an end anchor

Cuyose
Builder

For some reason I have not been able to get a field extraction to work where the end anchor will be a GUID. Basically the events are as follows

Exception=This is the exception - wrong thing here. - 32c18521-1313-41e6-8ff6-1e1fb986a321

What would the field extraction for this look like?

This isn't even working for me
(?i)Exception=(?P[^[0-9a-f]{8}]+)

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works on regex101 using your sample data.

Exception=(?P<exception>.*)(?P<GUID>.{8}-.{4}-.{4}-.{4}-.{12})
---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Give this a try

(?i)Exception=(?P<Exception>.*)(\s*-+\s*)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}$
0 Karma

Cuyose
Builder

This has worked! Thanks. Odd though, When I was changing the field extraction in the manager, then rerunning the query, I was not noticing the extraction. Only when I edited the existing search then ran did it get the correct extractions. Re-pasting the original then also got the extractions.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What exactly do you want extracted from your sample event?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Cuyose
Builder

This is what I am attempting to extract
This is the exception - wrong thing here.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does the exception always end with '.'? We can't stop at an 8-character word or we risk losing part of the exception text.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Cuyose
Builder

No it does not always end with a . I want to set the logic to:
Capture everything between Exception= and a GUID, which will always be 8-4-4-4-12 alphanumeric characters.

I know this is totally doable, but I am not able to get splunks version of regex to work.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...