Splunk Search

HOW TO GET FULL NAME USING REGEX FROM RAW DATA

hrs2019
Path Finder

Hello
How i can get the full name from log ie. Name=Busaram Manjraj
i am trying with this regex |rex field=-_raw "(?<Name>[^&]+)\s*\d*"
but it is giving just Name=Busaram not the full name.

Splunk raw data looks like
Name=Busaram, Manjraj

Labels (2)
0 Karma

PickleRick
Champion

Firstly, if you want the regex not to capture the "Name=" part, you should specify it explicitly before the capture group.

Name=(?<Name>[^&]+)\s*\d*

Secondly, for me, it works (if you give proper field name):

PickleRick_0-1636820282181.png

Thirdly, why the \d* at the end? You have more data you're not showing us?

0 Karma

hrs2019
Path Finder

@PickleRick Thanks for your reply i have added the screenshot for my output please have a look and the log also.
test1000.PNG

Tags (1)
0 Karma

PickleRick
Champion

I don't know what your "-_raw" field is supposed to mean. The field name (with an exception for splunk's internal field like _raw or _time) has to start on a letter. Drop the "field=" option completely (even with matching _raw, you shouldn't use it - the rex command matches to _raw by default and specifying it explicitly can have performance impact - at least that's what the docs say).

If you match your regex to whole event, you should... get all event up to any apersand ("&") signs.

0 Karma

ashvinpandey
Contributor

@hrs2019 Can you please share the full raw log ?

0 Karma

hrs2019
Path Finder

added.

0 Karma

bhargavi
Path Finder

Hi @hrs2019 

Try this.

| rex "Name=(?P<Name>\w+\,\s\w+)"

 

bhargavi_0-1636958326971.png

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!