Splunk Search

How do I extract using regex?

sphiwee
Contributor

i have below result, how can I do a regex to extract the fields, first being DateTime, username, Action, Entity

2022-11-21 15:44:13,ea186520,CREATED,USERSESSIONLOG

Labels (2)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sphiwee,

you can use the Field User Extractor to extract these fields without using regexes, cebause they are comma separated fields.

If you want to use a regex, you can use this:

 

| rex "^(?<DateTime>[^,]*),(?<username>[^,]*),(?<Action>[^,]*),(?<Entity>[^,]*)"

 

that you can test at https://regex101.com/r/KMPkSa/1

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

It quite depends on how stable is the actual data format.  If all values have no comma in them as illustrated, you can simply do

| rex "(?<DateTime>[^,]+, *(?<username>[^,]+), *(?<Action>[^,]+), *(?<Entity>[^,]+)"
Tags (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...