Splunk Search

How to create a regex to extract fields between two hyphens?

Deepz2612
Explorer

Hi,help me in writing regex to extract field between two hyhpens.

Eg: S-STRA-32
F-FIDR-67

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Add this to your search:

... | rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"

This captures multiples, even sequentials like when you do this, which the others do not:

|makeresults | eval _raw="foo-bar-bat-boo"
| rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Add this to your search:

... | rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"

This captures multiples, even sequentials like when you do this, which the others do not:

|makeresults | eval _raw="foo-bar-bat-boo"
| rex max_match=0 "(?<=-)(?<betweenHyphens>[^-]+)(?=-)"
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval str="F-FIDR-67" 
| eval result = mvindex(split(str,"-"),1)
0 Karma

pranay_adla
Explorer
   | rex field=<yourfield> "\-(?P<field_name>\w+)\-"
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @Deepz2612,

Please try regex: -(?<your_field>.*)-. You will get value between two hyphen in "your_field" field.

This will work but if you have further information about elements on both side of hyphen you can make regex faster. For example I'm assuming we have only one characters on left side of hyphen and some digits on right side of hyphen we can use regex: [a-zA-Z]-(?<your_field>.*)-\d+.

Hope this helps!!!

0 Karma

harsmarvania57
Ultra Champion

Hi,

Please try below regex, it will extract data in new field called extracted_field

<yourBaseSearch>
| rex field=<yourfield> "^[^\-]+\-(?<extracted_field>[^\-]+)\-"
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...