Splunk Search

How to extract subword from a string?

aa0
Path Finder

Hi all,

I want to extract the following word with rex expression:

ABC\qq1234 

expected result: qq1234

Please note that the substring needed will always after ABC\. Any help will be appreciated!

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "ABC\\(?<subword>\w+)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "ABC\\(?<subword>\w+)"
0 Karma

aa0
Path Finder

Thanks a lot! It working well with 3 backslashes used instead in order to escape a backslash character.

0 Karma
Get Updates on the Splunk Community!

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...