Need help with REX, PLEASE

[nathbe01]

Hello, I am new to using REX wich is I believe is what I need. I have a field that has data that looks like this...

10.231.247.162--WTLDNDAA001--Can't ping DSLAM
10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM 
10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly 
172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM 
172.31.166.155--RSBGORBU--Can't ping DSLAM 


I want my table to ONLY show whats between the hyphens

Example I want to get 
WTLDNDAA-001

TCSUAZMS

CLSPCO32H01.2

RSBGORBU

Can anybody help me with creating a rex that removes everything not between the the 2 sets of hyphens.

Would be greatly appreciated!!

[bshuler_splunk · Accepted solution]

The regex I would use is :

--(?<myfield>[^-\n]+)--

You can see it in action here:

https://regex101.com/r/AbOMKk/1

or you can test it with SPL here:

| makeresults | eval data=split("10.231.247.162--WTLDNDAA001--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly%%172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM%%172.31.166.155--RSBGORBU--Can't ping DSLAM", "%%")| mvexpand data | rex field=data "--(?<myfield>[^-\n]+)--"

but as this looks like you are extracting the host, I would recommend using a props/transforms combination:

props.conf

[mysourcetype]
TRANSFORMS-hostoverride=mysourcetype_hostoverride

transforms.conf

[mysourcetype_hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^\d+\.\d+\.\d+\.\d+--(?<myfield>[^-\n]+)--
FORMAT = host::$1

This regex can be tested here:

https://regex101.com/r/AbOMKk/2

[nathbe01]

That worked, Thank you