Splunk Search

How to extract substring from a string

Path Finder

Hi Everyone,
I have a string field that contains similar values as given below:

String = This is the string (generic:ggmail.com)(3245612)
= This is the string (generic:abcdexadsfsdf.cc)(1232143)

I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that.

Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com)

May need to use regex. If someone can help me out, Thanks in advance.


Tags (3)
0 Karma



try with something like this


test it at https://regex101.com/r/2VG31q/1

0 Karma


You can try the following (this is very generic high leve regular expression which you might need to tweak based on your actual sample data):

| rex field=_raw "\(generic:(?<myField>[^\)].*)\)\("
| table _raw myField

Test out your regular expression on regex101.com with more sample data.
Also it is better if you create Field through Interactive Field Extraction (IFX), so that Splunk creates regular expression automatically based on sample data. Field Extraction Knowledge Object will serve better with re-usability and easy maintenance.

Step by Step documentation link : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...