Splunk Search

How can I extract these 3 values from this string via regex?

vinay4444
Explorer

Hi

I need a regex match on the below pattern. I need to capture 3 values from

"ms.db.tablespace_status_ind[DBID_FACT_D03,NORMAL]"

name -> ms.db.tablespace_status_ind
table-> DBID_FACT_D03
status-> NORMAL

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...