Splunk Search

How to extract part of the search string?

sarit_s
Communicator

Hello
I have a source path which from I want to extract 2 parts, each part to a different field

this is the path :

 /splunkdev/copyFilesAmerFDM.log

I want to extract "Amer" (can be anything, just always will be after "copyFiles"
and FDM (also can be anything will be always before .log)

this is what i came to but it is not working:

| rex field=source \/splunkdev\/copyFiles(?<Region>\w+)

Thanks

0 Karma
1 Solution

martinpu
Communicator

Try this:

  |rex field=source  "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"

View solution in original post

0 Karma

martinpu
Communicator

Try this:

  |rex field=source  "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"
0 Karma

sarit_s
Communicator

perfect! thanks

0 Karma

koshyk
Super Champion

Please try

 | rex field=source "\/copyFiles(?<Region>[A-Za-z]+))"

example in https://regex101.com/r/ae5Xyg/1

If you want to Split FDM Part, then

| rex field=source "\/copyFiles(?<Region>[A-Za-z]+)(?<fdmField>FDM).log"
0 Karma

DavidHourani
Super Champion

Hi @sarit_s,

Try this one to capture everything and to stop right before the FDM :

 | rex field=source "\/copyFiles(?<Region>[A-Z][a-z]+)"

Cheers,
David

0 Karma

sarit_s
Communicator

thanks David
it is catching only Amer, but if i have Region looks li "SA" for example it is not taking it

also, how can i take the FDM part ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...