Splunk Search

How to extract two values from a string using regex?

pc1234
Explorer

I'm requesting help constructing a regular expression for the following:

I need to extract two values from the string below:

[app/task/function/5]

field a='app' (string after first [ before first slash)
field b = '5' (value after last slash before closing]) 

Another example is:

[app/task/3]

fielda = app
fieldb= 3

In addition, I need the extraction to fail if a string of characters is found.
For example, the character string to exclude is 'function':

[function/app/2]

The extraction should fail since 'function' is contained in the string.

Any assistance would be appreciated.

Thanks in advance.

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pc1234,
use these two regexes:

| rex "^field\s*a\s*\=\s*(\'|\s)(?<fielda>\w+)"
| rex "^field\s*b\s*\=\s*(\'|\s)(?<fielda>\d+)"

You can test the first at https://regex101.com/r/circlS/1 and the second at https://regex101.com/r/circlS/2

Ciao.
Giuseppe

0 Karma

pc1234
Explorer

that only extracts the first value. it also doesn't address failing if a string of characters is found(see above)

0 Karma

493669
Super Champion

I updated answer please try again

0 Karma

493669
Super Champion

try @pc1234,
Updated:

...|rex "\[(?<field1>\w{3})\/.*\/(?<field2>\d)\]"
0 Karma
Get Updates on the Splunk Community!

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...