Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Need help with regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=...| search MESSAGE="CommonAsyncGETController.execute() : scope :S01234"| Table MESSAGE
Above is my string, I want to extract S01234 from MESSAGE="CommonAsyncGETController.execute() : scope :S01234" and have a new column called scope and output as below,
Scope
S01234
Please help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @ppanchal
Please try
| makeresults |eval message="CommonAsyncGETController.execute() : scope :S01234"| rex field=message "scope\s:(?P<scope>.+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @ppanchal
Please try
| makeresults |eval message="CommonAsyncGETController.execute() : scope :S01234"| rex field=message "scope\s:(?P<scope>.+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=...| search MESSAGE="CommonAsyncGETController.execute() : scope :S01234"| rex field=MESSAGE "(?:.+scope\s\:)(?P<Scope>\S+)" | Table MESSAGE Scope
At least, assuming that your original search is correct, that should give you a whole new field at search time called Scope, and S01234 will be the value. That being said, your search isn't going to find anything where the scope field would have a different value other than S01234... But that's a different question...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It only took me like three edits to realize that I wasn't messing up my typing but that I needed to put the named capture group in a code box... Jeezz....
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Make your Splunk investment work harder with Optimization Advisor
How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26
Make Your Machine Data AI-Ready in Splunk
