Splunk Search

Help with Regex

shruti14
Explorer

Hi, Can someone help me with field extraction for string :

/home/mysqld/databasename/audit/audit.log

I want to extract databasename as Database to be used 

i have written regex but getting error, can someone help with correct regex:

rex field=source "\/home\/\/mysqld\//(?<Database>.*)/audit\/"

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what error you're getting.

The regex has too many slashes. needs explicit <>, and the slash before "audit" must be escaped.  This works with the example data.

| rex field=source "\/home\/mysqld\/(?<Database>.*)\/audit\/"

  

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what error you're getting.

The regex has too many slashes. needs explicit <>, and the slash before "audit" must be escaped.  This works with the example data.

| rex field=source "\/home\/mysqld\/(?<Database>.*)\/audit\/"

  

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...