Splunk Search

How to edit my regex to remove all text before ":" if there is more than one

nikolaevnz
Engager

Hello Team, Splunkers, 

 

I am working on a correlation search and need to use a regex expression to strip all text before a column ":". Following the suggestion presented in: 

https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-regex-to-remove-all-text-before-an-opti...

 

I managed to strip the text using this expression which was derived from the topic above: 

 

| rex field=my_host "(?<my_host>[^\:]+)$"

 

and apply it to the following line: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D 

it will work and I will receive: my_host.server;D

However if I apply the above expression to the same line but with column at the end of the string looking like this: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D:

this will not be matched. Could you please assist me with editing my expression to cover both cases and still get my_host.server;D as a result.

 

Regards Nikolay

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

nikolaevnz
Engager

Thank you for the help it woks as intended. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...