Splunk Search
Highlighted

Feedback on regex on a single string

Communicator

I am trying to regex to get a substring
I want substring "addressON" from this string "ThisStreetaddressONblockb"

here is my query

host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>)\_blockb$" | table thisStreet

This is not working

0 Karma
Highlighted

Re: Feedback on regex on a single string

SplunkTrust
SplunkTrust

Try this

| rex (?P<thisStreet>_(\w+)_)

0 Karma
Highlighted

Re: Feedback on regex on a single string

Legend

You forgot the format of your regex:

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>[^ ]*)\_blockb$" | table thisStreet

in this way you take all chars but no spaces between the underscores.

Eventually try a different one on https://regex101.com/

Bye.
Giuseppe

0 Karma
Highlighted

Re: Feedback on regex on a single string

SplunkTrust
SplunkTrust

You're almost there. Your name search is missing the capturing regex. Try this

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet

Alternative, try this

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet

OR

  host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet

View solution in original post

Highlighted

Re: Feedback on regex on a single string

Communicator

For some weird reason only mvindex worked! Thanks!

0 Karma
Highlighted

Re: Feedback on regex on a single string

SplunkTrust
SplunkTrust

The other two methods rely on actual string available before and after the thisStreet that you're trying to extract. The regex in 1st and 3rd option is assuming you have a literal string "ThisStreet" before and "blockb" after. If they are not static/literal string, then try like this:-

 host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "[^_]+_(?<thisStreet>[^_]+)_.+$" | table thisStreet
0 Karma