Splunk Search

How do I use regex to select a string between two symbols?

ss394546910
Engager

Splunk logs looks like below:

userid=234user|rwe23|dwdwd --

userid=id123|34lod|2323 textHow can I get value between "=" and first "|"

I want to get table of value between "=" and first "|", like "234user" and "id123"

I tried:

index=indexhere "userid=" |regex "(?<==)(?<info>.+?)(?=\|)"
| dedup info
| table info

this one works fine in regex101, but shows 0 result in Splunk.
Could anyone please help? Any help would be appreciated. Thanks!

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Despite closeness in name, regex and rex are two very different commands.  From regex:

regex

Description

Removes results that match or do not match the specified regular expression.

I think you are looking for rex.

 

index=indexhere "userid="
|rex "=(?<info>[^|]+)"
| dedup info
| table info

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Despite closeness in name, regex and rex are two very different commands.  From regex:

regex

Description

Removes results that match or do not match the specified regular expression.

I think you are looking for rex.

 

index=indexhere "userid="
|rex "=(?<info>[^|]+)"
| dedup info
| table info

 

ss394546910
Engager

Yes..seems like I am looking for rex not regex. Thanks for helping.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex command filters events - it does not extract fields.  To extract fields, use the rex command.  Also, avoid lookbehind in regexes - they're not necessary and take longer to process.

index=indexhere "userid=" 
| rex "userid=(?<info>[^\|]+?)"
| dedup info
| table info
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...