Splunk Search

Need help with regex

ppanchal
Path Finder

index=...| search MESSAGE="CommonAsyncGETController.execute() : scope :S01234"| Table MESSAGE

Above is my string, I want to extract S01234 from MESSAGE="CommonAsyncGETController.execute() : scope :S01234" and have a new column called scope and output as below,

Scope
S01234

Please help.

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Hi @ppanchal

Please try

| makeresults |eval message="CommonAsyncGETController.execute() : scope :S01234"| rex field=message "scope\s:(?P<scope>.+)"

View solution in original post

vnravikumar
Champion

Hi @ppanchal

Please try

| makeresults |eval message="CommonAsyncGETController.execute() : scope :S01234"| rex field=message "scope\s:(?P<scope>.+)"

michael_schmidt
Path Finder
index=...| search MESSAGE="CommonAsyncGETController.execute() : scope :S01234"| rex field=MESSAGE "(?:.+scope\s\:)(?P<Scope>\S+)" | Table MESSAGE Scope

At least, assuming that your original search is correct, that should give you a whole new field at search time called Scope, and S01234 will be the value. That being said, your search isn't going to find anything where the scope field would have a different value other than S01234... But that's a different question...

0 Karma

michael_schmidt
Path Finder

It only took me like three edits to realize that I wasn't messing up my typing but that I needed to put the named capture group in a code box... Jeezz....

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...