Splunk Search

How to make a field extraction with field with and without ':'?

Mike6960
Path Finder

Hi,

 

I am struggeling with field extractions. I have two fields that I want to extract. But the problem is sometimes te value is in 'Documentid : 123456789' and sometimes in 'DocumentId 123456789' so without the : 

Is it possible to make an extraction that extracts only the numbers after 'DocumentId' ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

View solution in original post

Mike6960
Path Finder

@ITWhisperer  Thank you. I made a mistake with he examples 

DocumentId 47335252 

DocumentId:47337177 

I changed your regex to :  | rex DocumentId:?(?<documentid>\d+) but then it does not recognize the first example (DocumentId:47337177 )  I wish I could understand regex more to fix it myself

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, is your actual example with either a space or a colon but not both?

 

 | rex "DocumentId(:| )(?<documentid>\d+)"

 

It might help if you paste your examples in a code block </> so it doesn't get auto-formatted

Mike6960
Path Finder

Yes, its either colon or a space. Your last reply worked. Thank you

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming it is just the colon that is missing and the two spaces are there:

| rex "Documentid :? (?<documentid>\d+)"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...