Splunk Search

How to create regex that will pick up on a value contained in [ ] brackets?

Splunky21
Explorer

Hi all,

I'm attempting to develop a regex that will pick up on a value contained in [ ] brackets (see below):

Log value

year number time:time:time 00 AAA0 Blah Blah Blah Blah Blah: [X] to [Y] (4 possible variables X,Y,A,B)

 

I need to alert every time the * to [ bracketed value] changes. Trying to make a regex to pick out these bracketed values. Any help is appreciated!

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this command to extract both values within brackets.

| rex "\[(?<bracket1>[^\]]+)\] to \[(?<bracket2>[^\]]+)"

It looks for the first bracket, extracts everything up to the second into field 'bracket1', then it looks for a closing bracket followed by " to " and a third bracket.  Everything up to the fourth bracket is put into field 'bracket2'.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this command to extract both values within brackets.

| rex "\[(?<bracket1>[^\]]+)\] to \[(?<bracket2>[^\]]+)"

It looks for the first bracket, extracts everything up to the second into field 'bracket1', then it looks for a closing bracket followed by " to " and a third bracket.  Everything up to the fourth bracket is put into field 'bracket2'.

 

---
If this reply helps you, Karma would be appreciated.

Splunky21
Explorer

That worked perfectly, thanks! 🙂 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...