Splunk Search

How can I extract these 3 values from this string via regex?

vinay4444
Explorer

Hi

I need a regex match on the below pattern. I need to capture 3 values from

"ms.db.tablespace_status_ind[DBID_FACT_D03,NORMAL]"

name -> ms.db.tablespace_status_ind
table-> DBID_FACT_D03
status-> NORMAL

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

Based on your sample event:

^(?<capture1>[^\[]+)\[(?<capture2>[^\,]+),(?<capture3>[^\]]+)\]

You can rename the capture groups to fix your needs... This also assumes that there are not quotes enclosing the event, and that its starts from the beginning of the line.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...