- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
Hi,
I need to extract a field from another field, no metadata fields.
The existing field (let's call it existing_field) has the following value:
class = 'blablabla' AND category = 'blablabla' AND ...
As you see the new two fields I need to extract are class and category and they are separated from AND.
What is the regex to extract them so I can add it to the .conf file?
Thanks,
Skender
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Try this:
... | rex field=existing_field "class = '(?P<class>\w+)' AND category = '(?P<category>\w+)'" | ...
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Try this:
... | rex field=existing_field "class = '(?P<class>\w+)' AND category = '(?P<category>\w+)'" | ...
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
It returns no errors but it doesn't work.
this regex is ok:
(?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND\s(?P\w+)
and here is a piece of sample data:
"existing_field": "class = 'Servizio...' AND category = 'Materiale...' AND ( ticket_type = 'Change Request' and ticket_impact_code = '2' ) AND ( ticket_type = 'Change Request' and ticket_urgency_code = '2' )"...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
This regex will work if the fields contain only word characters. Try this as an alternative:
class = '(?P<class>[^ ]+)' AND category = '(?P<category>[^ ]+)'
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
And how about extracting entire strings (with white spaces included), not only words?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
This regex extracts fields with spaces from your example.
class = '(?P<class>.*?)' AND category = '(?P<category>.*?)'
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
Thanks a lot:
I resolved it this way:
| rex field=existing_field "class = (?P.*?) AND category = (?P.*?) AND"
Skender
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
I comfirm: the values are only word characters.
I tried this but I get no new fields extracted:
| rex field=sql_where_clause "class = '(?P[^ ]+)' AND category = '(?P[^ ]+)'"
should I cancel the extraction row I added in relative sourcetype in the props.conf?
Skender
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
sql_where_clause is the existing_field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
I added in the sourcetype in my props.conf:
EXTRACT-my_extraction = (?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND\s(?P\w+) in existing_field
but I do not see the new fields yet...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
You need to name the fields you are extracting (perhaps you did so and the editor dropped them). What's more, the capturing groups need to be around the right side of the equals sign or all you will capture is the field name.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
Here is a sample of the data Iquinn:
"existing_field": "class = 'jhaskjdhsakjdhsakjdh' AND category = 'dhjkashdjkahdkajhdkaj' AND (hdsgahsdgasdgadgjjasgdhagdhasgd"...
as far as I know this is part of JSON data...
Thanks,
Skender
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
Ok I wrote this one and it works for the sample:
^(?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND(?P\s\w+)
Here you have the sample text:
NAME OF THE FIELD
existing_field_from_json
VALUE
class = 'kdjaldja' AND category = 'shdgahgdhadgjad' AND some_other_text_here...
Now, how to put this regex to extract the information from the existing field?
And how to insert the eval stanza in the props.conf?
Skender
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![DMohn DMohn](https://community.splunk.com/legacyfs/online/avatars/336305.jpg)
You could use the rex
command
your_search_here | rex field=existing_field "^.*\= '(?\w+)'.*\= '(?\w+)'.*$"
More details on the command can be found here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex
Otherwise try to use the graphical field extractor: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/ExtractfieldsinteractivelywithIFX
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you give a sample of a whole event?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![skender27 skender27](https://community.splunk.com/legacyfs/online/avatars/309673.jpg)
here is some sample text:
"existing_field: class = 'Service One...' AND category = 'Materials Two...' AND ( ticket_type = 'Change Request' and ticket_impact_code = '2' ) AND ( ticket_type = 'Change Request' and ticket_urgency_code = '2' )"...
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)