Splunk Search

Help with regex for field extraction

mbasharat
Contributor

Hi,

I have a field value as below.
These are all fixed positions all across.

/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/

I need two regex:

  1. Only State extracted from above new fields labeled as STATE
  2. All fields extracted as LOCATION, STATE, CITY, CODE

Thanks in advance!!!

0 Karma
1 Solution

mbasharat
Contributor

After banging my head for a bit, I coded below run any where and it worked!!! 🙂

| gentimes start=-1 

| eval Location="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/"

| table Location

| rex field=Location "^(?:[^\/\n]*\/){2}(?P<State>\w+)\/(?P<City>[^\/]+)\/(?P<Code>[^\/]+)"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/" 
| rex "^\/(?<WHATEVER>[^\/]+)\/(?<LOCATION>[^\/]+)\/(?<STATE>[^\/]+)\/(?<CITY>[^\/]+)\/"

I am not sure what is supposed to be CODE ... ?

0 Karma

mbasharat
Contributor

After banging my head for a bit, I coded below run any where and it worked!!! 🙂

| gentimes start=-1 

| eval Location="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/"

| table Location

| rex field=Location "^(?:[^\/\n]*\/){2}(?P<State>\w+)\/(?P<City>[^\/]+)\/(?P<Code>[^\/]+)"
0 Karma

arjunpkishore5
Motivator

Could you please provide some more sample inputs and the expected output. For example, when you say you need LOCATION, STATE, CITY, CODE, what values should each of these hold with respect to your sample data?

0 Karma

mbasharat
Contributor

Hi Arjun. See my own answer to my own question. Took some head bangs at this time of Friday! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...