Splunk Search

Need help on rex

Annna
Explorer

wed } } }, { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00" open "S" : "12:00" } } } } }, "email" : { "S" : " DHours" } } }, "email" : { "S" : " Hours" } } }]

| rex "wed.\D}.\D.\D.(?<sample>.*)DHours

i used above rex and gives the result like

{ "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }, "email" : { "S" : "

but i need below output

Result should be like 

{ "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Annna,

the results you have from your regex is the correct one for your regex, please try this:

| rex "wed.\D}.\D.\D.(?<sample>.*),\s+\"email\".*DHours"

that you can test at  https://regex101.com/r/CutdeR/1

Ciao.

Giuseppe

View solution in original post

0 Karma

Annna
Explorer

its working. Thank you..!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Annna,

good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Annna,

the results you have from your regex is the correct one for your regex, please try this:

| rex "wed.\D}.\D.\D.(?<sample>.*),\s+\"email\".*DHours"

that you can test at  https://regex101.com/r/CutdeR/1

Ciao.

Giuseppe

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!