Splunk Search

How to create a regex to extract field values?

jacqu3sy
Path Finder

Hi,

I need a regex to extract the value 'Fred' in quotes after the User declaration below;

,"User:"Fred",

So any value between the quotes after the : and up to the ,

I don't really want the quotes returned in the results. Struggling as I'm a regex wuss!

Thanks in advance for any help!

0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Hi,

Try something like below,

| your search | rex field=_raw "User:\"(?<user>[^\"]+)"

example with your data:

| makeresults | eval _raw=",\"User:\"Fred\"," 
| rex field=_raw "User:\"(?<user>[^\"]+)"

Happy Splunking...

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi,

Try something like below,

| your search | rex field=_raw "User:\"(?<user>[^\"]+)"

example with your data:

| makeresults | eval _raw=",\"User:\"Fred\"," 
| rex field=_raw "User:\"(?<user>[^\"]+)"

Happy Splunking...

————————————
If this helps, give a like below.
0 Karma

jacqu3sy
Path Finder

Nearly worked, I needed another set of quotes after User i.e.

"User":\"(?[^\"]+)"

Works now. Thanks!

0 Karma

jacqu3sy
Path Finder

But thats my fault as I left those off in my example!! My bad. Thanks for your help.

0 Karma

HiroshiSatoh
Champion

Try this!

| makeresults |eval _raw=",\"User:\"Fred\","|  rex field=_raw "User:\"(?P<User>.*)\""
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...