Splunk Search

Is there a better way to edit my regular expression?

Accak
Path Finder

Hey guys,
I have field with values like:

RQT4 - Ownership foo barr
R11: Assistance fooo barr 192392
RQR11 -RFI A lot of text and digits

I want to cut the beginning with RQR/R/RQT, "/", ":" and whitespaces

My search (working on regex101.com)

| rex field=fieldToExtract mode=sed "s/^(RQT|RQR|R|r)\d+(\s\W\s|\s\W|\W\s|\W|\s)//"  | 

And still its not working for all values, f.e

RQT11 - Apply remove CMS
RQT2 - Library creation - (1)
R11 - Apply RAW
RQR3 - RDI Remove

Any ideas why?
I bet there is better way to do it. For example Cut all before first 3 word characters which are not RQR or RQT, or R\d\d.
Thanks in advance!

0 Karma
1 Solution

Accak
Path Finder

I just added "g" on the end and it's workig.

| rex field=fieldToExtractmode=sed "s/^R\w+\d+\W+//g"|

But still don't know what "g" acctualy make.

View solution in original post

0 Karma

Accak
Path Finder

I just added "g" on the end and it's workig.

| rex field=fieldToExtractmode=sed "s/^R\w+\d+\W+//g"|

But still don't know what "g" acctualy make.

0 Karma

Accak
Path Finder

Thanks Accak

0 Karma

Accak
Path Finder

You are welocme Accak

0 Karma

woodcock
Esteemed Legend

g is for global meaning it will repeat the same command over and over until it gets to the end of the string and cannot match any more.

Accak
Path Finder

I managed to short it :

| rex field=fieldToExtract mode=sed "s/^(R|r)\w+\d+\W+//" |

But still the same values stay unchanged.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...