Splunk Search

How to extract content from field using rex?

ivana27
Path Finder

Dears,

please help. I have log like this 

[Information] PosService AddInfo:[5006] - Stop customer

And i want to show in table message after ":", currently i am using rex like this but i dont have result:

| rex field=_raw "PosService\sAddInfo\:(?<addinfo>\w+|)"

 

Thank you!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

if the code you need to display is only the code between square parenthesis, you could use a regex like this:

| rex "PosService\s+AddInfo:\[(?<addinfo>\d+)"

as you can see at https://regex101.com/r/dtpR2J/1

If instead you need to display all the message until the end of the row, you have to use the following regex:

| rex "PosService\s+AddInfo:(?<addinfo>.+)"

 as you can see at https://regex101.com/r/dtpR2J/2

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

if the code you need to display is only the code between square parenthesis, you could use a regex like this:

| rex "PosService\s+AddInfo:\[(?<addinfo>\d+)"

as you can see at https://regex101.com/r/dtpR2J/1

If instead you need to display all the message until the end of the row, you have to use the following regex:

| rex "PosService\s+AddInfo:(?<addinfo>.+)"

 as you can see at https://regex101.com/r/dtpR2J/2

Ciao.

Giuseppe

General_Talos
Path Finder

@ivana27 

I hope @gcusello  answer suffice.

If you want to extract after ":" (and considering whatever before ":") you can also use

":\[(?<addinfo>\d+)]"
OR
":(?<addinfo>.+)"

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...