Splunk Search

How to apply regex to lookup table field?

Taruchit
Contributor

Hello All,

I have a lookup file with multiple fields. I am reading it using inputlookup command and implementing some filters. Now  I need to apply regex on a field and extract the corresponding matched string from each row of the lookup into a separate field.

The regex is: xxx[\_\w]+:([a-z_]+)

Thus, I need your guidance and inputs to build the same.

Thank you

Taruchit

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=fieldA "xxx[\_\w]+:(?<res>[a-z_]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You need to specify a field that you wish the extracted pattern to be put in - for example:

xxx[\_\w]+:(?<fieldname>[a-z_]+)
0 Karma

Taruchit
Contributor

Hello @ITWhisperer,

Thank you for your response. 

Can you please help with example of how to write the code?

|inputlookup myTable.csv
|where _time=relative_time(now(),"-1d@d")

Now I need to apply the regular expression on fieldA and store the extracted data from each row in field: res.

It would be very helpful if you could help.

Thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=fieldA "xxx[\_\w]+:(?<res>[a-z_]+)"

Taruchit
Contributor

Thank you @ITWhisperer for your prompt help.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...