How to extract a dynamic String that is comma delimited (it comes directly after a constant)?

[lordhans]

The Splunk logs I'm working with are big and don't come with any predefined useful fields. I want to extract a dynamic String that is delimited by two commas and comes directly after a constant.

Here is an example:

~someMethodHere,0000-CODE012 ,ClientID,NA,6728233,

The "~someMethodHere,0000-CODE012" will be a constant and is what I am using in the search query. Directly after the constant is a space, then a comma, then the ClientID, then another comma. I want to extract "ClientID". The ClientID is dynamic and can be any letters or numbers. Also, the "~someMethodHere,0000-CODE012 ,ClientID,NA,6728233," example is surrounded by lots of other logging info that is irrelevant to this particular detail.

I think I should use a regex here but I'm not sure how to only start the regex AFTER "~someMethodHere,0000-CODE012 ," and then delimit using the following comma. Would really appreciate any help here.

Thanks!

[micahkemp · Accepted solution]

~someMethodHere,0000-CODE012 ,(?<client_id>[^,]+),

The only real logic here is [^,] which matches anything except a comma. The regex matches one or more of those characters followed by a comma.

[cpetterborg]

The regex for the example data that you have above would likely be something like:

someMethodHere,0000-CODE012 ,(?P<clientid>[^,]*),

Depending on your use of the above regex, you may have to modify it slightly, but if you use a rex command, that should work.