Splunk Search

How to create a regex to extract field values?

jacqu3sy
Path Finder

Hi,

I need a regex to extract the value 'Fred' in quotes after the User declaration below;

,"User:"Fred",

So any value between the quotes after the : and up to the ,

I don't really want the quotes returned in the results. Struggling as I'm a regex wuss!

Thanks in advance for any help!

0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Hi,

Try something like below,

| your search | rex field=_raw "User:\"(?<user>[^\"]+)"

example with your data:

| makeresults | eval _raw=",\"User:\"Fred\"," 
| rex field=_raw "User:\"(?<user>[^\"]+)"

Happy Splunking...

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi,

Try something like below,

| your search | rex field=_raw "User:\"(?<user>[^\"]+)"

example with your data:

| makeresults | eval _raw=",\"User:\"Fred\"," 
| rex field=_raw "User:\"(?<user>[^\"]+)"

Happy Splunking...

————————————
If this helps, give a like below.
0 Karma

jacqu3sy
Path Finder

Nearly worked, I needed another set of quotes after User i.e.

"User":\"(?[^\"]+)"

Works now. Thanks!

0 Karma

jacqu3sy
Path Finder

But thats my fault as I left those off in my example!! My bad. Thanks for your help.

0 Karma

HiroshiSatoh
Champion

Try this!

| makeresults |eval _raw=",\"User:\"Fred\","|  rex field=_raw "User:\"(?P<User>.*)\""
0 Karma
Get Updates on the Splunk Community!

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Professionals: Build Resilience and Visibility with These .conf25 ...

  If you're focused on performance, availability, and full-stack visibility, the Observability track at ...

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...