How to extract string after special character

[eli_da]

Hello everyone,

I have a simple question about rex, I have not been successful.

I have a string:

"bllablla_toni" 
"bloobloo_jony"

And I am want to extract the string after character "_".
The result will be:

"toni" 
"jony"

Thanks!

[eli_da]

,Is work

Thank!

[vnravikumar]

Hi @eli_da

Try this simple rex

| makeresults 
| eval str="bllablla_toni,bloobloo_jony" 
| makemv delim="," str 
| rex field=str "\_(?P<result>\w+)" 
| mvexpand result 
| table result

[jaime_ramirez]

Hi

The following should do the trick:

[^_]+\_(?<extracted_string>.*)

Applied to rex (just copy and paste into splunk directly):

| makeresults 
| eval events="bllablla_toni bloobloo_jony"
| eval events=split(events, " ")
| mvexpand events
| rename events as strings
| rename COMMENT AS "--- Sample Generated Events Above ---"
| rex field=strings "[^\_]+\_(?<extracted_string>.*)"

Hope it helps