Splunk Search

How to create a regex for extracting few characters of a field?

Communicator

My VLAN value looks like below:

|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) 

Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.

0 Karma

Esteemed Legend

Come back and click Accept on the best answer, @surekhasplunk!

0 Karma

Esteemed Legend

There are many ways. Here is another one:

... | rex field=VLAN mode=sed "s/\(.*$//"

For example:

| makeresults 
| eval VLAN="vlan(foo)" 
| rex field=VLAN mode=sed "s/\(.*$//"
0 Karma

Champion

Hi

Try this,

| makeresults 
| eval VLAN ="Vlan819(RVP_CDN)" 
| eval result = mvindex(split(VLAN,"("),0)
0 Karma

Legend

Hi surekhasplunk,
it could be useful to share a sample of your logs.
Anyway, you could use something like this

| rex "Vlan819<VLAN>\w+)"

to test with a sample.

Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

@surekhasplunk ,

Try

|rex field=VLAN "(?<VLAN>.+)\("

Ultra Champion

Looks great -

| makeresults 
| eval VLAN="Vlan819(RVP_CDN)" 
| rex field=VLAN "(?<VLAN>.+)\("
0 Karma