Splunk Search

Help in Regex

vrmandadi
Builder

I have the field message - Method: Execute | Class: GetUsersByVinActivity
message- Method: Execute | Class: DecodeVinActivity

I want the method and class to extract as new fields from the message field

Thanks in advance

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi vrmandadi,

if the events are always in the format of the example you can use this regex:

 your search here to get the events 
| rex max_match=0 field=message "Method:\s(?<Method>[^\s]+)\s\|\sClass:\s(?<Class>[^\s]+)" 
| table _time Method Class

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi vrmandadi,

if the events are always in the format of the example you can use this regex:

 your search here to get the events 
| rex max_match=0 field=message "Method:\s(?<Method>[^\s]+)\s\|\sClass:\s(?<Class>[^\s]+)" 
| table _time Method Class

Hope this helps ...

cheers, MuS

vrmandadi
Builder

Thanks a lot Mus

0 Karma

jrbanks6
Explorer

^\w+\s+.\s+\w+.\s+\w+\s+\w+.\s+\w+.\s+(?\w+\s+).\s+\w+.\s+(?\w+)

This is a "Greedy" RegEx - Regex101.com is your friend!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...