Splunk Search

How to create a regex for extracting few characters of a field?

surekhasplunk
Communicator

My VLAN value looks like below:

|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) 

Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.

0 Karma

woodcock
Esteemed Legend

Come back and click Accept on the best answer, @surekhasplunk!

0 Karma

woodcock
Esteemed Legend

There are many ways. Here is another one:

... | rex field=VLAN mode=sed "s/\(.*$//"

For example:

| makeresults 
| eval VLAN="vlan(foo)" 
| rex field=VLAN mode=sed "s/\(.*$//"
0 Karma

vnravikumar
Champion

Hi

Try this,

| makeresults 
| eval VLAN ="Vlan819(RVP_CDN)" 
| eval result = mvindex(split(VLAN,"("),0)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
it could be useful to share a sample of your logs.
Anyway, you could use something like this

| rex "Vlan819<VLAN>\w+)"

to test with a sample.

Bye.
Giuseppe

0 Karma

renjith_nair
Legend

@surekhasplunk ,

Try

|rex field=VLAN "(?<VLAN>.+)\("
---
What goes around comes around. If it helps, hit it with Karma 🙂

ddrillic
Ultra Champion

Looks great -

| makeresults 
| eval VLAN="Vlan819(RVP_CDN)" 
| rex field=VLAN "(?<VLAN>.+)\("
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...