Splunk Search

How to edit my regex to remove all text before ":" if there is more than one

nikolaevnz
Engager

Hello Team, Splunkers, 

 

I am working on a correlation search and need to use a regex expression to strip all text before a column ":". Following the suggestion presented in: 

https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-regex-to-remove-all-text-before-an-opti...

 

I managed to strip the text using this expression which was derived from the topic above: 

 

| rex field=my_host "(?<my_host>[^\:]+)$"

 

and apply it to the following line: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D 

it will work and I will receive: my_host.server;D

However if I apply the above expression to the same line but with column at the end of the string looking like this: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D:

this will not be matched. Could you please assist me with editing my expression to cover both cases and still get my_host.server;D as a result.

 

Regards Nikolay

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

nikolaevnz
Engager

Thank you for the help it woks as intended. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...