Splunk Search

How to extract a substring of existing field values into a new field?

chvnc
Explorer

I want to make a new field with extracted values like Header.txt, LogMessage.xml , JSON_HEADER.json (it's from the second _ to the end of the string)

Sample data:

/home/collection/collections/data/TIBCOJNDIQAT4A/export/20/PL-ADMIN-11004.30A5748A69B1:ADF086E40_20160621223510_Header.txt

/home/collection/collections/data/TIBCOJNDIQAT4A/export/20/PL-ADMIN-11004.30A5748A69B1:ADF086E40_20160621223510_LogMessage.xml

/home/collection/collections/data/TIBCOJNDIQAT4A/export/20/PL-ADMIN-11004.30A5748A69B1:ADF086E40_20160621223510_JSON_HEADER.json
0 Karma

sk314
Builder

Try this:

rex field=<your_field> "([A-Za-z0-9]+_){2}(?<extracted_field>[^.]+.[^$\n ]+)"

Disclaimer: This is a lousy regex.Someone will surely swoop in and save the day with an optimal regex.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...