Splunk Search

Extracting string from field in lookup

Rgk_Trail
Explorer

Hi, 

I have a  few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. 

Can anyone recommend how should I go about this ? 

I have attached lookup field and result of rex command that I want. 

 

- Thanks 

Rohan K.

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Worked like a charm ! 

Thanks a lot. 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi Rohan,

You can try this:
... your search | rex field="Title" "\:\s+(?<Name>[^\d]+)"

Assumptions:

- Names will always come between : and a digit. 

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...