Splunk Search

How to extract string from lookup field?

nathanluke86
Communicator

Hi,

 

I need to extract a string from a field in a lookup.

need to extract between <query> and <query>  and the field name is "eai:data"

any help would be appreciated.

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,

if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:

| rex field=your_lookup_field "\<query\>(?<eai:data>[^\<]*)"

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @nathanluke86,

if you could share some sample of your data I could be more detailed, anyway, please try a regex like this:

| rex field=your_lookup_field "\<query\>(?<eai:data>[^\<]*)"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...