Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract a string with regex?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I'm having trouble extracting the string "RES ONE Workspace Agent". Can anyone please tell me where I'm going wrong?
rex field=pluginText "(?P(^RES ONE Workspace Agent$))"
[installed on 2017/11/09]\nRES ONE Workspace Agent [version 10.1.200.0]
Much appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!
^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).
Probably this would work:
| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"
Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@FrankVl In this way
from_mail_id = MariaDubois@example.com
to_mail_id = zecora@buttercupgames.com
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @FrankVl How to extract from and To fields For this below Line using Regex
Info: Bounced: DCID 8413617 MID 19338947 From: <MariaDubois@example.com> To: <zecora@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])
Please help me with the Solution ,Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! You may have better luck with your question if you post individually instead of as a reply!
If you need help with anything- please don't hesitate to reach out!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!
^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).
Probably this would work:
| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"
Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Frank, worked like a charm.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
