Splunk Search

Extracting string from field in lookup

Rgk_Trail
Explorer

Hi, 

I have a  few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. 

Can anyone recommend how should I go about this ? 

I have attached lookup field and result of rex command that I want. 

 

- Thanks 

Rohan K.

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Worked like a charm ! 

Thanks a lot. 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi Rohan,

You can try this:
... your search | rex field="Title" "\:\s+(?<Name>[^\d]+)"

Assumptions:

- Names will always come between : and a digit. 

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...