Splunk Search

How to extract part of a text from log events?

jerin1982
New Member

I am very new to regex and I need to extract anything that comes between "device_" and "_1_vol" as volume name.

"device_array02_im-wxs-vb004_p2_lun_215_1_vol
"device_array03_serverb_p2_lun_139_1_vol"

The below output is from the actual log

"Alert 0202 : The Read Latency of array Volume : device_array02_im-wxs-vb004_p2_lun_215_1_vol is at 125717.0 us"

I tried word boundaries but it's not working. Can someone please help me?

"(?P\bdevice\w+\b)_1_vol"

Tags (1)
0 Karma
2 Solutions

cmerriman
Super Champion

will something like this work?

device_(?<volumeName>.*)_1_vol

View solution in original post

bonnlbbelandres
Path Finder

Hi, I can't really provide the specific regex code for you. But just incase you find suggestions, you can try it out here: http://regexr.com/
Just paste your samples and see if their regex code works.

And since you are also starting to learn regex like me, that site also provide information on how to use regex.

View solution in original post

0 Karma

bonnlbbelandres
Path Finder

Hi, I can't really provide the specific regex code for you. But just incase you find suggestions, you can try it out here: http://regexr.com/
Just paste your samples and see if their regex code works.

And since you are also starting to learn regex like me, that site also provide information on how to use regex.

0 Karma

jerin1982
New Member

Thank you. I will look into it.

0 Karma

cmerriman
Super Champion

will something like this work?

device_(?<volumeName>.*)_1_vol

jerin1982
New Member

Thank you so much. It worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...