Splunk Search

Extracting string from field in lookup

Rgk_Trail
Explorer

Hi, 

I have a  few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. 

Can anyone recommend how should I go about this ? 

I have attached lookup field and result of rex command that I want. 

 

- Thanks 

Rohan K.

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Worked like a charm ! 

Thanks a lot. 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi Rohan,

You can try this:
... your search | rex field="Title" "\:\s+(?<Name>[^\d]+)"

Assumptions:

- Names will always come between : and a digit. 

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...