Splunk Search

HOW TO GET FULL NAME USING REGEX FROM RAW DATA

hrs2019
Path Finder

Hello
How i can get the full name from log ie. Name=Busaram Manjraj
i am trying with this regex |rex field=-_raw "(?<Name>[^&]+)\s*\d*"
but it is giving just Name=Busaram not the full name.

Splunk raw data looks like
Name=Busaram, Manjraj

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, if you want the regex not to capture the "Name=" part, you should specify it explicitly before the capture group.

Name=(?<Name>[^&]+)\s*\d*

Secondly, for me, it works (if you give proper field name):

PickleRick_0-1636820282181.png

Thirdly, why the \d* at the end? You have more data you're not showing us?

0 Karma

hrs2019
Path Finder

@PickleRick Thanks for your reply i have added the screenshot for my output please have a look and the log also.
test1000.PNG

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I don't know what your "-_raw" field is supposed to mean. The field name (with an exception for splunk's internal field like _raw or _time) has to start on a letter. Drop the "field=" option completely (even with matching _raw, you shouldn't use it - the rex command matches to _raw by default and specifying it explicitly can have performance impact - at least that's what the docs say).

If you match your regex to whole event, you should... get all event up to any apersand ("&") signs.

0 Karma

ashvinpandey
Contributor

@hrs2019 Can you please share the full raw log ?

0 Karma

hrs2019
Path Finder

added.

0 Karma

bhargavi
Path Finder

Hi @hrs2019 

Try this.

| rex "Name=(?P<Name>\w+\,\s\w+)"

 

bhargavi_0-1636958326971.png

 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...