Splunk Search

How to write the regex to extract this string between the 3rd and 6th underscores in my sample data?

deenadp
Explorer

Hi,

I would like to extract the strings between multiple delimiters as below.

INPUT : src=`D:\GENEOS Program Files\App\FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log`

From the above I need to extract only JOBS_APACHE_DISPLAY.

Can you please help? I have tried with multiple regex options, but it also fetches additional strings.

Below is my attempt:

| eval log=replace(src,"([^\\\]+\\\)","")| eval Name=substr(log,1,len(log)-13)| eval Name=substr(Name,12,len(log))

req: need to display the strings between 3rd and 6th _ from

> FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log
1 Solution

sundareshr
Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex field=src "(?:[^_]+_){3}(?<capture>[^_]+_[^_]+_[^_]+)_"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Since your question mentioned regex, here's a solution using rex

... | rex field=src "\w+_\w+_\w+_(?<log>\w+_\w+_\w+)_" | ...
---
If this reply helps you, Karma would be appreciated.

sundareshr
Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

axl88
Communicator

This should work as well as better regex with lookahead lookbehind.

0 Karma

deenadp
Explorer

the values at the end "1190FA52.log" is not constant (not always 13 at end)

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...