Splunk Search

How to extract substring from a string

Path Finder

Hi Everyone,
I have a string field that contains similar values as given below:

String = This is the string (generic:ggmail.com)(3245612)
= This is the string (generic:abcdexadsfsdf.cc)(1232143)

I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that.

Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com)

May need to use regex. If someone can help me out, Thanks in advance.


Tags (3)
0 Karma



try with something like this


test it at https://regex101.com/r/2VG31q/1

0 Karma


You can try the following (this is very generic high leve regular expression which you might need to tweak based on your actual sample data):

| rex field=_raw "\(generic:(?<myField>[^\)].*)\)\("
| table _raw myField

Test out your regular expression on regex101.com with more sample data.
Also it is better if you create Field through Interactive Field Extraction (IFX), so that Splunk creates regular expression automatically based on sample data. Field Extraction Knowledge Object will serve better with re-usability and easy maintenance.

Step by Step documentation link : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...