Splunk Search

How to extract a dynamic String that is comma delimited (it comes directly after a constant)?

lordhans
Explorer

The Splunk logs I'm working with are big and don't come with any predefined useful fields. I want to extract a dynamic String that is delimited by two commas and comes directly after a constant.

Here is an example:

~someMethodHere,0000-CODE012 ,ClientID,NA,6728233,

The "~someMethodHere,0000-CODE012" will be a constant and is what I am using in the search query. Directly after the constant is a space, then a comma, then the ClientID, then another comma. I want to extract "ClientID". The ClientID is dynamic and can be any letters or numbers. Also, the "~someMethodHere,0000-CODE012 ,ClientID,NA,6728233," example is surrounded by lots of other logging info that is irrelevant to this particular detail.

I think I should use a regex here but I'm not sure how to only start the regex AFTER "~someMethodHere,0000-CODE012 ," and then delimit using the following comma. Would really appreciate any help here.

Thanks!

0 Karma
1 Solution

micahkemp
Champion

~someMethodHere,0000-CODE012 ,(?<client_id>[^,]+),

The only real logic here is [^,] which matches anything except a comma. The regex matches one or more of those characters followed by a comma.

View solution in original post

micahkemp
Champion

~someMethodHere,0000-CODE012 ,(?<client_id>[^,]+),

The only real logic here is [^,] which matches anything except a comma. The regex matches one or more of those characters followed by a comma.

cpetterborg
SplunkTrust
SplunkTrust

The regex for the example data that you have above would likely be something like:

someMethodHere,0000-CODE012 ,(?P<clientid>[^,]*),

Depending on your use of the above regex, you may have to modify it slightly, but if you use a rex command, that should work.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...