How to extract the field using Regex?

[kiran331]

HI,

How to extract the field "AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}" from the below field

ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}

[aaraneta_splunk]

@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[woodcock · Accepted solution]

As asked:

(AppGUID-\{[^\}]+\})

As I suspect desired:

AppGUID-(?<AppGUID>\{[^\}]+\})

[mpreddy]

try like this:

|stats c|eval _raw="ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}"|rex field=_raw "AppGUID..(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})"

[starcher]

Assuming the field is called guid:

| rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)"