Splunk Search

How to regex match?

kc_prane
Communicator

 Hi,

This is a raw log  Job=[IN-SNMMIS-DLY]], 

I am trying to build regex just the words " IN-SNMMIS-DLY]" 

and ignore the parenthesis  

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex "Job=\[(?<job>[^\]]+)\]"

 

 

0 Karma

kc_prane
Communicator

Thankyou@ITWhisperer

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I think @ITWhisperer pressed Enter before complete typing. (This happened to me today, too. Something on the forum interface might be off.)  Assuming the field Job is already extracted, a usable regex would be "^\[.+\]$".  To use in rex command:

|rex field=Job "^\[(?<Job_no_bracket>.+)\]$"

If Job is not extracted and you are only interested in the part inside brackets,

| rex "=\[(?<Job_no_bracket>.+)\]$"

This last one only works if there's nothing after "Job=[IN-SNMMIS-DLY]]" in _raw.

 

0 Karma

kc_prane
Communicator

Thanks a lot, @Yuanilu that regex worked for me.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...