How to extract substring from a string

[bagarwal]

Hi Everyone,
I have a string field that contains similar values as given below:

String = This is the string (generic:ggmail.com)(3245612)
= This is the string (generic:abcdexadsfsdf.cc)(1232143)

I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that.

Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com)

May need to use regex. If someone can help me out, Thanks in advance.

Regards,
Binay

[gcusello]

Hi

try with something like this

\(generic:(?<Field>[^\)]*)\)\(

test it at https://regex101.com/r/2VG31q/1
Bye.
Giuseppe

[niketn]

You can try the following (this is very generic high leve regular expression which you might need to tweak based on your actual sample data):

| rex field=_raw "\(generic:(?<myField>[^\)].*)\)\("
| table _raw myField

Test out your regular expression on regex101.com with more sample data.
Also it is better if you create Field through Interactive Field Extraction (IFX), so that Splunk creates regular expression automatically based on sample data. Field Extraction Knowledge Object will serve better with re-usability and easy maintenance.

Step by Step documentation link : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

[bagarwal]

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂