Splunk Search

How to extract part of the search string?

sarit_s
Communicator

Hello
I have a source path which from I want to extract 2 parts, each part to a different field

this is the path :

 /splunkdev/copyFilesAmerFDM.log

I want to extract "Amer" (can be anything, just always will be after "copyFiles"
and FDM (also can be anything will be always before .log)

this is what i came to but it is not working:

| rex field=source \/splunkdev\/copyFiles(?<Region>\w+)

Thanks

0 Karma
1 Solution

martinpu
Communicator

Try this:

  |rex field=source  "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"

View solution in original post

0 Karma

martinpu
Communicator

Try this:

  |rex field=source  "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"
0 Karma

sarit_s
Communicator

perfect! thanks

0 Karma

koshyk
Super Champion

Please try

 | rex field=source "\/copyFiles(?<Region>[A-Za-z]+))"

example in https://regex101.com/r/ae5Xyg/1

If you want to Split FDM Part, then

| rex field=source "\/copyFiles(?<Region>[A-Za-z]+)(?<fdmField>FDM).log"
0 Karma

DavidHourani
Super Champion

Hi @sarit_s,

Try this one to capture everything and to stop right before the FDM :

 | rex field=source "\/copyFiles(?<Region>[A-Z][a-z]+)"

Cheers,
David

0 Karma

sarit_s
Communicator

thanks David
it is catching only Amer, but if i have Region looks li "SA" for example it is not taking it

also, how can i take the FDM part ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...