Splunk Search

How to extract a dynamic String that is comma delimited (it comes directly after a constant)?

lordhans
Explorer

The Splunk logs I'm working with are big and don't come with any predefined useful fields. I want to extract a dynamic String that is delimited by two commas and comes directly after a constant.

Here is an example:

~someMethodHere,0000-CODE012 ,ClientID,NA,6728233,

The "~someMethodHere,0000-CODE012" will be a constant and is what I am using in the search query. Directly after the constant is a space, then a comma, then the ClientID, then another comma. I want to extract "ClientID". The ClientID is dynamic and can be any letters or numbers. Also, the "~someMethodHere,0000-CODE012 ,ClientID,NA,6728233," example is surrounded by lots of other logging info that is irrelevant to this particular detail.

I think I should use a regex here but I'm not sure how to only start the regex AFTER "~someMethodHere,0000-CODE012 ," and then delimit using the following comma. Would really appreciate any help here.

Thanks!

0 Karma
1 Solution

micahkemp
Champion

~someMethodHere,0000-CODE012 ,(?<client_id>[^,]+),

The only real logic here is [^,] which matches anything except a comma. The regex matches one or more of those characters followed by a comma.

View solution in original post

micahkemp
Champion

~someMethodHere,0000-CODE012 ,(?<client_id>[^,]+),

The only real logic here is [^,] which matches anything except a comma. The regex matches one or more of those characters followed by a comma.

cpetterborg
SplunkTrust
SplunkTrust

The regex for the example data that you have above would likely be something like:

someMethodHere,0000-CODE012 ,(?P<clientid>[^,]*),

Depending on your use of the above regex, you may have to modify it slightly, but if you use a rex command, that should work.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...