Splunk Search

How to extract the field using Regex?

kiran331
Builder

HI,

How to extract the field "AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}" from the below field

ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

As asked:

(AppGUID-\{[^\}]+\})

As I suspect desired:

AppGUID-(?<AppGUID>\{[^\}]+\})

View solution in original post

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

As asked:

(AppGUID-\{[^\}]+\})

As I suspect desired:

AppGUID-(?<AppGUID>\{[^\}]+\})
0 Karma

mpreddy
Communicator

try like this:

|stats c|eval _raw="ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}"|rex field=_raw "AppGUID..(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})"

0 Karma

starcher
Influencer

Assuming the field is called guid:

| rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)"

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...