Splunk Search

How to extract a field between two patterns in a search for further stats processing?

atanasmitev
Path Finder

I have a _raw field with the following data in:

..............    "Stuff\":\"CAPITALS_AND_UNDERSCORES\",      ...........

The way I see it, I need to extract everything between "Stuff\":\" and ", patterns.

Can you help me extract the CAPITALS_AND... info from this line to a field, so that I further perform "stats" searches ?.
Splunk build is 6.0.1 if it matters.

1 Solution

MuS
Legend

Hi atanasmitev,

try something like this:

your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ...

This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex.

small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi atanasmitev,

try something like this:

your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ...

This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex.

small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

Hope this helps ...

cheers, MuS

atanasmitev
Path Finder

Works thanks 🙂 Finally . All I needed was to add another search option before the regexp, like so

my base search "Stuff" | rex field=thefield_to_rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ... 

It seems like the entire field to regexp followed the same "ID" : "Info" notation, so instead of extract all it did was print 🙂
The rex works like a charm, yet my search was wrong 😄

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...