Splunk Search

How to extract only first occurrence between two strings in the paragraph of string in Splunk?

rpachamuthu
Explorer

Extract only first occurrence between two strings in the paragraph of string in splunk

index=perf-*** source=*ResponseDataErrorAnalyzer*
|rex field=_raw "scriptnamestart(?<ScriptName>[\w\D]+)scriptnameend"
|table ScriptName

I want to capture the first occurrence an store in the  ScriptName  and display in the table data
scriptnamestartreceiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Getscriptnameend<someText>

 

 

Labels (2)
0 Karma

rut
Path Finder

The match continues until the second instance of “scriptnameend”. The following pattern uses a lookahead, so it should break at the first instance of “scriptnameend”:

 

| rex field=_raw "scriptnamestart(?<ScriptName>.+?(?=scriptnameend))scriptnameend"

 

 I tested the above, it returns “receiving_S02_sat_Get”.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I missed the embedded terminator.  Use a non-greedy quantifier to stop at the first occurrence.

| rex "scriptnamestart(?<ScriptName>[\w\D]+?)scriptnameend"
---
If this reply helps you, Karma would be appreciated.

rut
Path Finder

That's a more effective pattern (148 vs 178 steps), use @richgalloway's pattern :)!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have expressed a desire and provided a means to achieve that desire.  How did the query fail you?

By default, the rex command will return only the first match.  According to regex101.com, your query should return "receiving_S02_sat_Getscriptnameend<someText>scriptnamestartReceiving_S02_sat_Get" from the sample text.  Is that not what you want?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...