Splunk Search

How to extract a word between two words?

New Member

stream=stdout 9 INFO [DataEnrichmentController] (default task-597) start : comm-uuid : rsvp-service : nljnj42343n43k

stream=stdout 4 INFO [DataEnrichmentController] (default task-760) start : commID : rsvp-service : nk324kjln4kj34

stream=stdout 4 INFO [DataEnrichmentController] (default task-760) start : comm-uuid : rsvp-service : vflijiopjoe1442kljn;k23

I want to extract the highlighted word from above log lines

Labels (2)
0 Karma


Alternatively, you can count the separators, like this

| eval myfield = mvindex(split(_raw), " : "), 2)
Tags (2)
0 Karma

Esteemed Legend

Hi @spatt,

please try this regex:

| rex "start\s+:[^:]*:\s+(?<your_field>[^:]*)"

or this one:

| rex field=stream "start\s+:[^:]*:\s+(?<your_field>[^:]*)"

that you can test at https://regex101.com/r/lWKlbK/1



0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...