Splunk Search

How to apply regex to lookup table field?

Taruchit
Contributor

Hello All,

I have a lookup file with multiple fields. I am reading it using inputlookup command and implementing some filters. Now  I need to apply regex on a field and extract the corresponding matched string from each row of the lookup into a separate field.

The regex is: xxx[\_\w]+:([a-z_]+)

Thus, I need your guidance and inputs to build the same.

Thank you

Taruchit

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=fieldA "xxx[\_\w]+:(?<res>[a-z_]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You need to specify a field that you wish the extracted pattern to be put in - for example:

xxx[\_\w]+:(?<fieldname>[a-z_]+)
0 Karma

Taruchit
Contributor

Hello @ITWhisperer,

Thank you for your response. 

Can you please help with example of how to write the code?

|inputlookup myTable.csv
|where _time=relative_time(now(),"-1d@d")

Now I need to apply the regular expression on fieldA and store the extracted data from each row in field: res.

It would be very helpful if you could help.

Thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=fieldA "xxx[\_\w]+:(?<res>[a-z_]+)"

Taruchit
Contributor

Thank you @ITWhisperer for your prompt help.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...