Splunk Search

How to write the regex to extract this string between the 3rd and 6th underscores in my sample data?

deenadp
Explorer

Hi,

I would like to extract the strings between multiple delimiters as below.

INPUT : src=`D:\GENEOS Program Files\App\FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log`

From the above I need to extract only JOBS_APACHE_DISPLAY.

Can you please help? I have tried with multiple regex options, but it also fetches additional strings.

Below is my attempt:

| eval log=replace(src,"([^\\\]+\\\)","")| eval Name=substr(log,1,len(log)-13)| eval Name=substr(Name,12,len(log))

req: need to display the strings between 3rd and 6th _ from

> FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log
1 Solution

sundareshr
Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex field=src "(?:[^_]+_){3}(?<capture>[^_]+_[^_]+_[^_]+)_"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Since your question mentioned regex, here's a solution using rex

... | rex field=src "\w+_\w+_\w+_(?<log>\w+_\w+_\w+)_" | ...
---
If this reply helps you, Karma would be appreciated.

sundareshr
Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

axl88
Communicator

This should work as well as better regex with lookahead lookbehind.

0 Karma

deenadp
Explorer

the values at the end "1190FA52.log" is not constant (not always 13 at end)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...