Splunk Search

How to write regex to represent only first part of value?

mark_groenveld
Path Finder

I have a key:value for db names but need only the first part.

Example

Current
DBNAME : db001_inst1:schemanamexyx
Or
DBNAME : db01_inst1:schemanamexyx

Requested
REX statement to provide only the values in front of the colon.  I.E., db001_inst1 or db01_inst1

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried already.

Try this

| rex field=db_name "(?<key>[^:]+)"

Be sure to change "db_name" to name of the field containing the key:value.  Don't use _raw or this won't work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mark_groenveld,

you could try this regex

| rex ":\s+(?<your_field>[^:]+)"

that you can test at https://regex101.com/r/pj1bQO/1

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried already.

Try this

| rex field=db_name "(?<key>[^:]+)"

Be sure to change "db_name" to name of the field containing the key:value.  Don't use _raw or this won't work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mark_groenveld
Path Finder

Thanks Rich for the solution.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mark_groenveld,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...