Splunk Search

How do I extract a field between two strings using a regular expression?

rohanmiskin
Explorer

I have logs having string like:

127.0.0.1|> GET /alldata
127.0.0.1|> GET /somedata
127.0.0.1|> GET /nodata
127.0.0.1|> POST /nodata
127.0.0.1|> PUT /nodata
127.0.0.1|> DELETE /nodata

I want to extract the field between 127.0.0.1|> and /
i.e i need GET,POST,PUT,DELETE to be in an extracted field.

NOTE: There's a space after > and before /

0 Karma

vnravikumar
Champion

Hi @rohanmiskin

Try this and let me know

| makeresults 
| eval sampledata ="127.0.0.1|> GET /somedata" 
| rex field="sampledata" ">\s(?P<method>.*)\s\/"
0 Karma

renjith_nair
Legend

@rohanmiskin ,

Try

"\>\s(?<ACTION>\w+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...