Splunk Search

Need help on Rex

sbhatnagar88
Path Finder

Hi ,

can some one help me with the rex command to extract the string included in first [] from below pattern. For example: string to filter from below pattern is Proxy - Zscaler, Teams, Exchange and extract it under field "CI_Name"

[Proxy - Zscaler] [xxxxxxxr] USA US-22 Peer 2

[Teams] [xxxxxxx] Mexico Login - MX (proxy)

[Exchange] [xxxxx] Mexico Outlook Send Email - MX (proxy)

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\[(?<CI_Name>[^\]]+)\]\s\["

View solution in original post

0 Karma

sbhatnagar88
Path Finder

Thanks @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\[(?<CI_Name>[^\]]+)\]\s\["

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!