Splunk Search

How to extract a string with regex?

dgillette3
Explorer

Hello!

I'm having trouble extracting the string "RES ONE Workspace Agent". Can anyone please tell me where I'm going wrong?

rex field=pluginText "(?P(^RES ONE Workspace Agent$))" 

[installed on 2017/11/09]\nRES ONE Workspace Agent [version 10.1.200.0]

Much appreciated!

0 Karma
1 Solution

FrankVl
Ultra Champion

Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!

^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).

Probably this would work:

| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"

Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?

View solution in original post

Kumar2
Loves-to-Learn Lots

@FrankVl In this way 

from_mail_id = MariaDubois@example.com
to_mail_id = zecora@buttercupgames.com

0 Karma

Kumar2
Loves-to-Learn Lots

Hi @FrankVl How to extract from and To fields For this below Line using Regex

Info: Bounced: DCID 8413617 MID 19338947 From: <MariaDubois@example.com> To: <zecora@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])

Please help me with the Solution ,Thanks 

0 Karma

yeasuh
Splunk Employee
Splunk Employee

Hello! You may have better luck with your question if you post individually instead of as a reply! 

If you need help with anything- please don't hesitate to reach out! 

0 Karma

FrankVl
Ultra Champion

Can you please use the code button (101010) to post any search queries and sample data? Looks like some special characters may have gotten lost!

^ and $ match start and end of the line. Since the string you want to extract is in the middle of the data, that doesn't work (assuming the sample you shared is the content of the pluginText field on which you apply the regex).

Probably this would work:

| rex field=pluginText "(?<fieldname>RES ONE Workspace Agent)"

Just out of curiosity: what is your purpose with extracting a literal string like that? Couldn't you just as well do: | eval field = "RES ONE Workspace Agent"?

dgillette3
Explorer

Thank you Frank, worked like a charm.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...