Splunk Search

How to create Rex for extracting a value from string?

Coder1a
Loves-to-Learn

Hello, I am new to splunk rex, need help for below to extract a value from string.

rex "Error while calling database for id = (?<id>.*)"

Example string: "Error while calling database for id =8748723874_1"

Output should be 8748723874

Thanks.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

You didn't show the result or explain why the result is wrong.  Do you mean you just want to get rid of the part after underscore _?  Normally, Splunk should have given you a field id that contains value 8748723874_1.  If so, always work from the smaller data.  You do not need regex for this task.  Just do

| eval id = mvindex(split(id, "_"), 1)

If Splunk doesn't give you this field, you can do

| rex "Error while calling database for id\s*=\s*(?<id>[^_]+)"

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...