Splunk Search

How to write the regex to extract this field?

splunker9999
Path Finder

Hi ,

Can someone please suggest the regex for this field extraction?

We need to extract de from below context with field as Name:

csc-3.0.1/r1_de_ *:1012

Thanks

0 Karma

gabriel_vasseur
Contributor

It would help if you could provide many examples of the data, so that we can understand what's variable and what's always the same, as that is key to design a good regex.

sundareshr
Legend

Try this

.. | rex "_(?<Name>\w+)_" | ...

*OR*

.. | rex "_(?<Name>\w{2})_" | ...
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Hey @splunker9999 This will work. The way I learned it was by going to regex101.com and pasting the text and writing regex to make it work

(?<=r1\_)de

splunker9999
Path Finder

Hi , This doesn't works.

I used below
^[^/\n]*/\w+\d+_(?P[a-z]+)

Thanks

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I forgot to mention that the point of regular expressions is to match patterns so if you had any other text than "r1_de" then it will not pick it up. Instead the regex should look like the one below, where it will pick up on digits and letters rather than hardcoded values

(?<=\w\_)\w{2}

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...