Splunk Search
Highlighted

How to extract a string from a field that contains space characters?

New Member

Hello,

I would like to extract a string from a field which contains Space characters.
This is the Text Field that is already extracted:

<Text>Launched application: FilmView, PID: 5180</Text>

I used the following search:

rex field=Text ": (? Application> \w+) ,"

I didn't work for me. What should be the right command?
If it can be done, I would like to extract the PID field as well.

Thanks

0 Karma
Highlighted

Re: How to extract a string from a field that contains space characters?

SplunkTrust
SplunkTrust

Try this:

| rex field=Text "application: (?<Application>[^\,]+)\, PID: (?<PID>\d+)"