Splunk Search

How to develop a regular expression to use with a field extraction?

hegeman1982
Engager

I am trying to come up with a regular expression to use with the field extractor that would return the value of a string between two strings. The basic formatting is the following:

[nls-string-val raw="Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top[/nls-string-val]

I would want the field extractor regex to return the following: Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top

*the '[' symbols above are actually '<' symbols but this forum would not let me post links. *
I was trying to use lookbehind and lookahead but was not having any success.

Any tips for how to accomplish this? The REGEX I have tried is "[nls-string-val raw="(.*)<\/nls-string-val>) and it doesn't work"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@hegeman1982 - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < symbols. If you wish to show the < (i.e. you are displaying sample code or regular expressions), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar.

somesoni2
Revered Legend

Give this a try (test it in a search using inline rex command before putting in props.conf)

your base search | rex "nls-string-value raw=\"(?<FieldName>[^\<]+)\<\/nls-string-val" 
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...