Splunk Search

How to extract a field between two patterns in a search for further stats processing?

atanasmitev
Path Finder

I have a _raw field with the following data in:

..............    "Stuff\":\"CAPITALS_AND_UNDERSCORES\",      ...........

The way I see it, I need to extract everything between "Stuff\":\" and ", patterns.

Can you help me extract the CAPITALS_AND... info from this line to a field, so that I further perform "stats" searches ?.
Splunk build is 6.0.1 if it matters.

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi atanasmitev,

try something like this:

your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ...

This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex.

small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi atanasmitev,

try something like this:

your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ...

This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex.

small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

Hope this helps ...

cheers, MuS

atanasmitev
Path Finder

Works thanks 🙂 Finally . All I needed was to add another search option before the regexp, like so

my base search "Stuff" | rex field=thefield_to_rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ... 

It seems like the entire field to regexp followed the same "ID" : "Info" notation, so instead of extract all it did was print 🙂
The rex works like a charm, yet my search was wrong 😄

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...