How to extract a field between two patterns in a search for further stats processing?

[atanasmitev]

I have a _raw field with the following data in:

..............    "Stuff\":\"CAPITALS_AND_UNDERSCORES\",      ...........

The way I see it, I need to extract everything between "Stuff\":\" and ", patterns.

Can you help me extract the CAPITALS_AND... info from this line to a field, so that I further perform "stats" searches ?.
Splunk build is 6.0.1 if it matters.

[MuS · Accepted solution]

Hi atanasmitev,

try something like this:

your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ...

This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex.

small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

Hope this helps ...

cheers, MuS

[atanasmitev]

Works thanks 🙂 Finally . All I needed was to add another search option before the regexp, like so

my base search "Stuff" | rex field=thefield_to_rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ... 

It seems like the entire field to regexp followed the same "ID" : "Info" notation, so instead of extract all it did was print 🙂
The rex works like a charm, yet my search was wrong 😄