Splunk Search

Extracting string from field in lookup

Rgk_Trail
Explorer

Hi, 

I have a  few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. 

Can anyone recommend how should I go about this ? 

I have attached lookup field and result of rex command that I want. 

 

- Thanks 

Rohan K.

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Worked like a charm ! 

Thanks a lot. 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi Rohan,

You can try this:
... your search | rex field="Title" "\:\s+(?<Name>[^\d]+)"

Assumptions:

- Names will always come between : and a digit. 

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...