Splunk Search

Help with Regex - Removing Text from Field

chrisschum
Path Finder

I have a field where results are 'some letter & number combination of 3 or 4 characters' that includes txt on the end I want to remove.

The text is made up of APSA< /ParticipantObjectQuery>< /ParticipantObjectIdentification>< /AuditMessage>".

So, how do I get rid of everything after the '3 or 4 character' value, which in this case is 'APSA'?

Thanks!

0 Karma
1 Solution

wenthold
Communicator

Try this:

 | rex field=LOC "^(?<yourValue>[\w]{3,4})"

As long as the 3- to 4- character value is at the beginning of the line this should work.

View solution in original post

wenthold
Communicator

Try this:

 | rex field=LOC "^(?<yourValue>[\w]{3,4})"

As long as the 3- to 4- character value is at the beginning of the line this should work.

chrisschum
Path Finder

That worked! Thanks!

0 Karma

kartm2020
Communicator

Hi,
As per your comment, If the character is alphanumeric value. Below regex will help you extract.

| rex field=_raw "(?P[A-Z0-9]{4})"

Please correct me if my understanding is wrong.

You can test it : https://regex101.com/r/j7u1vF/1
You can change the value inside parenthesis as per your requirement( I pretend it is 4 character value)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi chrisschum,
I could be more precise if you could share an example of your values and of the values to extract.
Anyway, if you field is called APSA, you want to extract ParticipantObjectQuery, ParticipantObjectIdentification and AuditMessage fields and an example is abc1 de2 fgh3.txt, you could use something like this:

| rex field=APSA "^(?<ParticipantObjectQuery>[^ ]*)\s+(?<ParticipantObjectIdentification>[^ ]*)\s+(?<AuditMessage>[^\.]*)"

You can test it at https://regex101.com/r/j7u1vF/1

Ciao.
Giuseppe

0 Karma

chrisschum
Path Finder

Thanks Giuseppe!

I'm actually wanting to get rid of everything after the APSA (or any other 3 to 4 alphanumeric value). The field is actually already extracted as LOC.

So what I get when I run a search is LOC= "3 or 4 character alphanumeric value"< /ParticipantObjectQuery>< /ParticipantObjectIdentification>< /AuditMessage>

What I want the results to be is LOC="3 or 4 character alphanumeric value"

Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Sorry I don'r understand: could you share an example of your data and the result you want?
Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...