Feedback on regex on a single string

[smhsplunk]

I am trying to regex to get a substring
I want substring "addressON" from this string "ThisStreet_addressON_blockb"

here is my query

host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>)\_blockb$" | table thisStreet

This is not working

[somesoni2 · Accepted solution]

You're almost there. Your name search is missing the capturing regex. Try this

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet

Alternative, try this

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet

OR

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet

[smhsplunk]

For some weird reason only mvindex worked! Thanks!

[somesoni2]

The other two methods rely on actual string available before and after the thisStreet that you're trying to extract. The regex in 1st and 3rd option is assuming you have a literal string "ThisStreet_" before and "_blockb" after. If they are not static/literal string, then try like this:-

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "[^_]+_(?<thisStreet>[^_]+)_.+$" | table thisStreet

[gcusello]

You forgot the format of your regex:

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>[^ ]*)\_blockb$" | table thisStreet

in this way you take all chars but no spaces between the underscores.

Eventually try a different one on https://regex101.com/

Bye.
Giuseppe

[skoelpin]

Try this

| rex (?P<thisStreet>_(\w+)_)