Splunk Search

How to write regex to represent only first part of value?

mark_groenveld
Path Finder

I have a key:value for db names but need only the first part.

Example

Current
DBNAME : db001_inst1:schemanamexyx
Or
DBNAME : db01_inst1:schemanamexyx

Requested
REX statement to provide only the values in front of the colon.  I.E., db001_inst1 or db01_inst1

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried already.

Try this

| rex field=db_name "(?<key>[^:]+)"

Be sure to change "db_name" to name of the field containing the key:value.  Don't use _raw or this won't work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mark_groenveld,

you could try this regex

| rex ":\s+(?<your_field>[^:]+)"

that you can test at https://regex101.com/r/pj1bQO/1

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried already.

Try this

| rex field=db_name "(?<key>[^:]+)"

Be sure to change "db_name" to name of the field containing the key:value.  Don't use _raw or this won't work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mark_groenveld
Path Finder

Thanks Rich for the solution.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mark_groenveld,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...