Splunk Search

How to extract value with in brackets

kavyatim
Path Finder

Hi ,
I have data in the following format:
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)
NOT_HOMOLOGATED-(UNKNOWN)
NOT_HOMOLOGATED-(UNKNOWN)
HOMOLOGATED-(ZTE ZXDSL 831 II V7.5.02_E09_BR1)
HOMOLOGATED-(Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6)
I would like to extract value with in the brackets i.e extracted values should be:
UNKNOWN
Thomson SpeedTouch ST510 V6 versao 6.2.15.7 or ST585 v6
UNKNOWN
ZTE ZXDSL 831 II V7.5.02_E09_BR1
and so on . . . . .

Can any one help me out in writing regex for this as it is not flexible with substring?

Thanking you in advance.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi kavyatim,

something like

YourFancySearch | rex "\((?<myField>.*)\)" 

should work fine for you.
Here is a link to a page were you can test regex on your data.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi kavyatim,

something like

YourFancySearch | rex "\((?<myField>.*)\)" 

should work fine for you.
Here is a link to a page were you can test regex on your data.

hope this helps ...

cheers, MuS

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...