Splunk Search

How to extract language field

martin_mueller
SplunkTrust
SplunkTrust

Converted from http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html

Hi,

i want to extract this field language:

language:ru-ru

can you please help me what regular expression should i write?

Thanks,
Snabel

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

language:(?<language>\w+-?\w*)

In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

language:(?<language>\w+-?\w*)

In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!