- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract a string from a field using Splunk Regex?
deepaksn1214
Engager
07-28-2023
12:47 PM
I m having a hard time trying to extract a string from a field from a splunk search using splunk regex , can someone help pls ?
The field looks like client_info=xxx-yyy=aaaa-bbb-cccc::4.144.1::web-app-id::plugin-id
I just want the string web-app-id and plugin-id extracted in separate fields named WebApp and Plugin.
Appreciate any help on this , thanks in advance !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
07-28-2023
01:28 PM
| rex "::(?<WebApp>[^:]+)::(?<Plugin>[^:]+)$"
