Splunk Search

How to make a field extraction with field with and without ':'?

Mike6960
Path Finder

Hi,

 

I am struggeling with field extractions. I have two fields that I want to extract. But the problem is sometimes te value is in 'Documentid : 123456789' and sometimes in 'DocumentId 123456789' so without the : 

Is it possible to make an extraction that extracts only the numbers after 'DocumentId' ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

View solution in original post

Mike6960
Path Finder

@ITWhisperer  Thank you. I made a mistake with he examples 

DocumentId 47335252 

DocumentId:47337177 

I changed your regex to :  | rex DocumentId:?(?<documentid>\d+) but then it does not recognize the first example (DocumentId:47337177 )  I wish I could understand regex more to fix it myself

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

Mike6960
Path Finder

Yes, its either colon or a space. Your last reply worked. Thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming it is just the colon that is missing and the two spaces are there:

| rex "Documentid :? (?<documentid>\d+)"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...