Splunk Search

How to write the regex to extract this string between the 3rd and 6th underscores in my sample data?

Explorer

Hi,

I would like to extract the strings between multiple delimiters as below.

INPUT : src=`D:\GENEOS Program Files\App\FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log`

From the above I need to extract only JOBS_APACHE_DISPLAY.

Can you please help? I have tried with multiple regex options, but it also fetches additional strings.

Below is my attempt:

| eval log=replace(src,"([^\\\]+\\\)","")| eval Name=substr(log,1,len(log)-13)| eval Name=substr(Name,12,len(log))

req: need to display the strings between 3rd and 6th _ from

> FILE_DC_BP_JOBS_APACHE_DISPLAY_1190FA52.log
1 Solution

Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

View solution in original post

Esteemed Legend

Like this:

... | rex field=src "(?:[^_]+_){3}(?<capture>[^_]+_[^_]+_[^_]+)_"
0 Karma

SplunkTrust
SplunkTrust

Since your question mentioned regex, here's a solution using rex

... | rex field=src "\w+_\w+_\w+_(?<log>\w+_\w+_\w+)_" | ...
---
If this reply helps you, an upvote would be appreciated.

Legend

Try this

.... |  eval src=split(src, "_") | eval log=mvindex(src, 3)."_".mvindex(src, 4)."_".mvindex(src, 5)

View solution in original post

Communicator

This should work as well as better regex with lookahead lookbehind.

0 Karma

Explorer

the values at the end "1190FA52.log" is not constant (not always 13 at end)

0 Karma