Splunk Search

How do I make a field extraction that selects only the first occurrence?

whrg
Motivator

Hello,
I have events that span multiple lines. One such event looks as follows:

...
# User details
ID: 123
Username: admin
Group: admin
Group: bin
...

Each event has at least one Group line.

I want to create a field extraction for the first occurence of Group.

So, for the example above the extracted field should have the value admin.

How do I create such a field extraction?

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

| rex Group:\s(?<group>\w+)\n+

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rex Group:\s(?<group>\w+)\n+
0 Karma

whrg
Motivator

Thank you for your answer!
When I test your regex then I see there are two match objects:
https://regex101.com/r/lQXqFx/1
How will Splunk behave in this case?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

It's working off that \n+ added at the end, saying grab only the first match. If this answered your question, please accept it and close it out

0 Karma

dkeck
Influencer

try this in splunk with the rex command its working

0 Karma

whrg
Motivator

It is working.
However, I cannot find any documentation as to Splunk handles multiple match objects.

0 Karma

dkeck
Influencer

by default its matching ungreedy, and if you want it to be global you can add flaggs.

I am not sure if there is any doc on that.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...