Splunk Search

How to make a field extraction with field with and without ':'?

Mike6960
Path Finder

Hi,

 

I am struggeling with field extractions. I have two fields that I want to extract. But the problem is sometimes te value is in 'Documentid : 123456789' and sometimes in 'DocumentId 123456789' so without the : 

Is it possible to make an extraction that extracts only the numbers after 'DocumentId' ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

View solution in original post

Mike6960
Path Finder

@ITWhisperer  Thank you. I made a mistake with he examples 

DocumentId 47335252 

DocumentId:47337177 

I changed your regex to :  | rex DocumentId:?(?<documentid>\d+) but then it does not recognize the first example (DocumentId:47337177 )  I wish I could understand regex more to fix it myself

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

Mike6960
Path Finder

Yes, its either colon or a space. Your last reply worked. Thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming it is just the colon that is missing and the two spaces are there:

| rex "Documentid :? (?<documentid>\d+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...