Splunk Search

Field Extraction

scout29
Path Finder

Need help to extract a field that comes after a certain word in a event. 

I am looking to extract a field called "sn_grp" with the value of "M2 Infra Ops". So for every event that has sn_grp:  i would like to extract the string that follows of "M2 Infra Ops". This string value will be the same name for every event.

Below is an example data set i am using to write the regex to 


\"sn_grp:M2 Infra Ops\"},{\"context\":\"CONTEXTLESS\",\"key\":\"Correspondence Routing Engine\

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

 

| rex "sn_grp:(?<sn_grp>[^\\]+)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started.

 

| rex "sn_grp:(?<sn_grp>[^\\]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

scout29
Path Finder

That seems to work however it is capturing the "\" in the string at the end. I want the value to stop after Ops in the string and not include the "\" 


0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try my revised answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...