Splunk Search

How to edit my regex to remove all text before ":" if there is more than one

nikolaevnz
Engager

Hello Team, Splunkers, 

 

I am working on a correlation search and need to use a regex expression to strip all text before a column ":". Following the suggestion presented in: 

https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-regex-to-remove-all-text-before-an-opti...

 

I managed to strip the text using this expression which was derived from the topic above: 

 

| rex field=my_host "(?<my_host>[^\:]+)$"

 

and apply it to the following line: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D 

it will work and I will receive: my_host.server;D

However if I apply the above expression to the same line but with column at the end of the string looking like this: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D:

this will not be matched. Could you please assist me with editing my expression to cover both cases and still get my_host.server;D as a result.

 

Regards Nikolay

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

nikolaevnz
Engager

Thank you for the help it woks as intended. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...