Splunk Search

How do you write a regular expression to extract a field which has characters, numbers and also special characters?

Deepz2612
Explorer

How do you write a regular expression to extract a field which has characters, numbers and also special characters? There are sometimes spaces in between.

I tried this. rex "(?\w+[A-Z0-9][^-])" --- to include characters and hyphen,
but it doesnt work

Thanks in advance!!

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Hi @Deepz2612

Try this, I included space and hyphen

([A-Za-z0-9*,\s-])

View solution in original post

0 Karma

kushagra9120
Explorer

this works for me :-

[\w\D]*

It would be better if you give the input data as well

0 Karma

vinod94
Contributor

hi @Deepz2612 ,

you can try this,

| rex "(?P<field_name>[a-zA-Z0-9\s].*)"
0 Karma

MoniM
Communicator

Hi @Deepz2612 ,

I tried this:-
([\w\D]+) for extracting "tirx-Ten @140gmail.com"

Thanks

0 Karma

FrankVl
Ultra Champion

\w includes digits, \D is non-digits. So combining those two means you match basically anything.

0 Karma

FrankVl
Ultra Champion

It would help if you would post some sample data and requirements on what you need to extract.

Regarding the regex you have: put it in on regex101.com and see the explanation of what it does, maybe that helps you spot the flaw.

Also: when posting code like that, please put it in between backticks: ` or use the 101010 button in the message editor toolbar to post it as a code snippet, so special characters don't disappear.

vnravikumar
Champion

Hi @Deepz2612

Try this, I included space and hyphen

([A-Za-z0-9*,\s-])

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...