Splunk Search

How to create a regex for extracting few characters of a field?

surekhasplunk
Communicator

My VLAN value looks like below:

|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) 

Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.

0 Karma

woodcock
Esteemed Legend

Come back and click Accept on the best answer, @surekhasplunk!

0 Karma

woodcock
Esteemed Legend

There are many ways. Here is another one:

... | rex field=VLAN mode=sed "s/\(.*$//"

For example:

| makeresults 
| eval VLAN="vlan(foo)" 
| rex field=VLAN mode=sed "s/\(.*$//"
0 Karma

vnravikumar
Champion

Hi

Try this,

| makeresults 
| eval VLAN ="Vlan819(RVP_CDN)" 
| eval result = mvindex(split(VLAN,"("),0)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
it could be useful to share a sample of your logs.
Anyway, you could use something like this

| rex "Vlan819<VLAN>\w+)"

to test with a sample.

Bye.
Giuseppe

0 Karma

renjith_nair
Legend

@surekhasplunk ,

Try

|rex field=VLAN "(?<VLAN>.+)\("
---
What goes around comes around. If it helps, hit it with Karma 🙂

ddrillic
Ultra Champion

Looks great -

| makeresults 
| eval VLAN="Vlan819(RVP_CDN)" 
| rex field=VLAN "(?<VLAN>.+)\("
0 Karma
Get Updates on the Splunk Community!

Celebrating the Winners of the ‘Splunk Build-a-thon’ Hackathon!

We are thrilled to announce the winners of the Splunk Build-a-thon, our first-ever hackathon dedicated to ...

Why You Should Register for Splunk University at .conf25

Level up before .conf25 even begins Splunk University is back in Boston, September 6–8, and it’s your chance ...

Building Splunk proficiency is a marathon, not a sprint

Building Splunk skills is a lot like training for a marathon. It’s about consistent progress, celebrating ...