Splunk Search

How to extract a string with regex?

Explorer

Hello!

I'm having trouble extracting the string "RES ONE Workspace Agent". Can anyone please tell me where I'm going wrong?

rex field=pluginText "(?P(^RES ONE Workspace Agent$))" 

[installed on 2017/11/09]\nRES ONE Workspace Agent [version 10.1.200.0]

Much appreciated!

0 Karma
1 Solution

Ultra Champion

Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!

^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).

Probably this would work:

| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"

Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?

View solution in original post

Ultra Champion

Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!

^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).

Probably this would work:

| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"

Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?

View solution in original post

Explorer

Thank you Frank, worked like a charm.

0 Karma