Splunk Search

How to extract the value from the field using rex sed cmd?

Babuduraiswamy
Engager

Hi, 

I looking for rex sed cmd to extract the value from the field.
eg: 

input field1 = d:\AppDynamics\machineagent\ver22.2.0.3282\bin\MachineAgentService.exe

output = ver22.2.0.3282

I need a valid sed cmd to filter the value everything before 3rd backslash and after 4th backslash.
eg: |rex field=version mode=sed "s/ /\*/g"

Thanks,

Babu

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Given the rigidity of data format, another method is split and mvindex.

| eval output = mvindex(split(field1, "\\"), 3) ``` SPL array is 0-based ```

Searching fixed patterns is usually less expensive than regex.

View solution in original post

Tags (2)

gcusello
SplunkTrust
SplunkTrust

Hi @Babuduraiswamy,

sorry, let me understand: do you want to extract a field that's a part of field1 or replace a part of field1?

sec cmd is used to replace a part of a string, not for extract a field.

If you want to extract the third part of your path in field1, you can use a rex command like this:

| rex field=field1 "^\w:\\([^\\]+\\){2}(?<version>[^\\]+)"

you can test the regex at https://regex101.com/r/Oy7Gxt/1

Ciao.

Giuseppe

yuanliu
SplunkTrust
SplunkTrust

Given the rigidity of data format, another method is split and mvindex.

| eval output = mvindex(split(field1, "\\"), 3) ``` SPL array is 0-based ```

Searching fixed patterns is usually less expensive than regex.

Tags (2)

Babuduraiswamy
Engager

Thanks, mvindex got worked..

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...