Splunk Search

Extracting string from field in lookup

Rgk_Trail
Explorer

Hi, 

I have a  few fields in lookup from which I am trying to extract strings. I read that rex is what I should be using. 

Can anyone recommend how should I go about this ? 

I have attached lookup field and result of rex command that I want. 

 

- Thanks 

Rohan K.

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Worked like a charm ! 

Thanks a lot. 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi Rohan,

You can try this:
... your search | rex field="Title" "\:\s+(?<Name>[^\d]+)"

Assumptions:

- Names will always come between : and a digit. 

------------
Hope I was able to help you. If so, some karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Edge Processor's Durable Queue Works

Edge Processor sits in one of the most consequential places in any Splunk pipeline: between your data sources ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...