Splunk Search

How to extract the value from the field using rex sed cmd?

Babuduraiswamy
Engager

Hi, 

I looking for rex sed cmd to extract the value from the field.
eg: 

input field1 = d:\AppDynamics\machineagent\ver22.2.0.3282\bin\MachineAgentService.exe

output = ver22.2.0.3282

I need a valid sed cmd to filter the value everything before 3rd backslash and after 4th backslash.
eg: |rex field=version mode=sed "s/ /\*/g"

Thanks,

Babu

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Given the rigidity of data format, another method is split and mvindex.

| eval output = mvindex(split(field1, "\\"), 3) ``` SPL array is 0-based ```

Searching fixed patterns is usually less expensive than regex.

View solution in original post

Tags (2)

gcusello
SplunkTrust
SplunkTrust

Hi @Babuduraiswamy,

sorry, let me understand: do you want to extract a field that's a part of field1 or replace a part of field1?

sec cmd is used to replace a part of a string, not for extract a field.

If you want to extract the third part of your path in field1, you can use a rex command like this:

| rex field=field1 "^\w:\\([^\\]+\\){2}(?<version>[^\\]+)"

you can test the regex at https://regex101.com/r/Oy7Gxt/1

Ciao.

Giuseppe

yuanliu
SplunkTrust
SplunkTrust

Given the rigidity of data format, another method is split and mvindex.

| eval output = mvindex(split(field1, "\\"), 3) ``` SPL array is 0-based ```

Searching fixed patterns is usually less expensive than regex.

Tags (2)

Babuduraiswamy
Engager

Thanks, mvindex got worked..

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...