Splunk Search

How to extract only first occurrence between two strings in the paragraph of string in Splunk?

rpachamuthu
Explorer

Extract only first occurrence between two strings in the paragraph of string in splunk

index=perf-*** source=*ResponseDataErrorAnalyzer*
|rex field=_raw "scriptnamestart(?<ScriptName>[\w\D]+)scriptnameend"
|table ScriptName

I want to capture the first occurrence an store in the  ScriptName  and display in the table data
scriptnamestartreceiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Getscriptnameend<someText>

 

 

Labels (2)
0 Karma

rut
Path Finder

The match continues until the second instance of “scriptnameend”. The following pattern uses a lookahead, so it should break at the first instance of “scriptnameend”:

 

| rex field=_raw "scriptnamestart(?<ScriptName>.+?(?=scriptnameend))scriptnameend"

 

 I tested the above, it returns “receiving_S02_sat_Get”.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I missed the embedded terminator.  Use a non-greedy quantifier to stop at the first occurrence.

| rex "scriptnamestart(?<ScriptName>[\w\D]+?)scriptnameend"
---
If this reply helps you, Karma would be appreciated.

rut
Path Finder

That's a more effective pattern (148 vs 178 steps), use @richgalloway's pattern :)!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have expressed a desire and provided a means to achieve that desire.  How did the query fail you?

By default, the rex command will return only the first match.  According to regex101.com, your query should return "receiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Get" from the sample text.  Is that not what you want?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...