Splunk Search

Feedback on regex on a single string

smhsplunk
Communicator

I am trying to regex to get a substring
I want substring "addressON" from this string "ThisStreet_addressON_blockb"

here is my query

host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>)\_blockb$" | table thisStreet

This is not working

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You're almost there. Your name search is missing the capturing regex. Try this

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet

Alternative, try this

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet

OR

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You're almost there. Your name search is missing the capturing regex. Try this

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet

Alternative, try this

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet

OR

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet

smhsplunk
Communicator

For some weird reason only mvindex worked! Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The other two methods rely on actual string available before and after the thisStreet that you're trying to extract. The regex in 1st and 3rd option is assuming you have a literal string "ThisStreet_" before and "_blockb" after. If they are not static/literal string, then try like this:-

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "[^_]+_(?<thisStreet>[^_]+)_.+$" | table thisStreet
0 Karma

gcusello
SplunkTrust
SplunkTrust

You forgot the format of your regex:

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>[^ ]*)\_blockb$" | table thisStreet

in this way you take all chars but no spaces between the underscores.

Eventually try a different one on https://regex101.com/

Bye.
Giuseppe

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rex (?P<thisStreet>_(\w+)_)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...