Splunk Search

Field Extraction

scout29
Path Finder

Need help to extract a field that comes after a certain word in a event. 

I am looking to extract a field called "sn_grp" with the value of "M2 Infra Ops". So for every event that has sn_grp:  i would like to extract the string that follows of "M2 Infra Ops". This string value will be the same name for every event.

Below is an example data set i am using to write the regex to 


\"sn_grp:M2 Infra Ops\"},{\"context\":\"CONTEXTLESS\",\"key\":\"Correspondence Routing Engine\

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

 

| rex "sn_grp:(?<sn_grp>[^\\]+)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

 

| rex "sn_grp:(?<sn_grp>[^\\]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

scout29
Path Finder

That seems to work however it is capturing the "\" in the string at the end. I want the value to stop after Ops in the string and not include the "\" 


0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try my revised answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...