Splunk Search

How do I use regex to select a string between two symbols?

ss394546910
Engager

Splunk logs looks like below:

userid=234user|rwe23|dwdwd --

userid=id123|34lod|2323 textHow can I get value between "=" and first "|"

I want to get table of value between "=" and first "|", like "234user" and "id123"

I tried:

index=indexhere "userid=" |regex "(?<==)(?<info>.+?)(?=\|)"
| dedup info
| table info

this one works fine in regex101, but shows 0 result in Splunk.
Could anyone please help? Any help would be appreciated. Thanks!

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Despite closeness in name, regex and rex are two very different commands.  From regex:

regex

Description

Removes results that match or do not match the specified regular expression.

I think you are looking for rex.

 

index=indexhere "userid="
|rex "=(?<info>[^|]+)"
| dedup info
| table info

 

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Despite closeness in name, regex and rex are two very different commands.  From regex:

regex

Description

Removes results that match or do not match the specified regular expression.

I think you are looking for rex.

 

index=indexhere "userid="
|rex "=(?<info>[^|]+)"
| dedup info
| table info

 

ss394546910
Engager

Yes..seems like I am looking for rex not regex. Thanks for helping.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex command filters events - it does not extract fields.  To extract fields, use the rex command.  Also, avoid lookbehind in regexes - they're not necessary and take longer to process.

index=indexhere "userid=" 
| rex "userid=(?<info>[^\|]+?)"
| dedup info
| table info
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...