Splunk Search

How to extract two fields using regex?

karthi2809
Builder

How to extract the two fields from the message ?

In this need to extract after API: START: /v1/expense/extract/demand/

nagl as one field .

demand _con.csv in another field

I am extracting 

|rex field=message max_match=0 "API: START: /v1/expense/extract/odemand/ (?<OnDemandFileName>[^\n]\w+\S+)"

 

API: START: /v1/expense/extract/demand/nagl/demand_con.csv

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @karthi2809,

if the first field is called app and the second is called OnDemandFileName, you can use this regex:

|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"

that you can test at https://regex101.com/r/uifAqM/1

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|rex field=message max_match=0 "API: START: /v1/expense/extract/demand/(?<oneField>[^\/]+)\/(?<anotherField>\S+)"

karthi2809
Builder

Working 👍

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @karthi2809,

if the first field is called app and the second is called OnDemandFileName, you can use this regex:

|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"

that you can test at https://regex101.com/r/uifAqM/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...