Splunk Search

How to extract string from lookup field?

nathanluke86
Communicator

Hi,

 

I need to extract a string from a field in a lookup.

need to extract between <query> and <query>  and the field name is "eai:data"

any help would be appreciated.

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,

if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:

| rex field=your_lookup_field "\<query\>(?<eai:data>[^\<]*)"

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,

if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:

| rex field=your_lookup_field "\<query\>(?<eai:data>[^\<]*)"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...