Splunk Search

How to skip/ignore one letter character from filtered log

Rakesh915473
Explorer

Hello Team,

 rex field=_raw "string_list=%25(?<new_field1>\w+)%25"

 

Above condition will get a word between %25 to %25, If I get any one/two letter word, I want to ignore/skip it.

Thanks for the help in advance.

@field-extraction

Labels (7)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
 rex field=_raw "string_list=%25(?<new_field1>\w{3,})%25"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
 rex field=_raw "string_list=%25(?<new_field1>\w{3,})%25"
0 Karma

Rakesh915473
Explorer

Great @ITWhisperer , Thanks :), It's  Working.

Can we also skip/ignore particular word in output.

Ex: Lets say, string_list= '%25USELESSWORD%25, %25HELLO%25'

I want to ignore 'USELESSWORD'.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
string_list=(%25USELESSWORD%25,\s*)*%25(?<new_field1>\w{3,})%25
0 Karma

Rakesh915473
Explorer

Thankyou @ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...