Splunk Search

How to Extract the data after second special character?

Neel881
Path Finder

Hello,

I want the extract everything after the second slash(/) 

OR

Everything from the last till the first slash (/)     -- Both scenario works for me

 

Example - 

generation/abcd/giveandtake-messages-to-s

generation/xyz/giveandtake-messages-speedline-s

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex ".+/.+/(?<message>.*)"

View solution in original post

Neel881
Path Finder

Perfect! Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex ".+/.+/(?<message>.*)"

PickleRick
SplunkTrust
SplunkTrust

Restricting the firs two strings to character classes

[^/]+/[^/]+/(?<message>.*)

 gives big performance boost (prevents backtracking).

Neel881
Path Finder

Thank you! 

Can we do from the end as well? Right to left till the special charater?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
/(?<message>[^/]+)$

PickleRick
SplunkTrust
SplunkTrust

If you want to capture everything after the last slash, you can do something like

.*/(?<message>[^/]*)$

 

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...