Splunk Search

Need help with regular expression/rex

Explorer

Hi,

Sorry I am having a tough time with this regular expression. I have a field named transaction_type and there are values in the field I want to extract. The field looks like this fieldA||fieldB||fieldC||fieldD. Now I want to be able to look at each individual field. I am having a tough time understanding how regular expressions work.

basic query | rex field=transaction_type "(?FieldB.*)||(?FieldC.*)" | table transaction_type FieldB

So I want my delimiter to be ||. I have tried multiple combinations and nothing is coming out as I expect it to.

Thank you for your help!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

(Edits: sorry, editor kept eating my fields)

One problem is escaping. The pipes | need to be escaped with a preceding \ character.

... | rex field=transaction_type "(?<f1>.*)\|\|(?<f2>.*)\|\|(?<f3>.*)\|\|(?<f4>.*)"

That takes an existing field that is already called "transaction_type" and looks like this: fieldA||fieldB||fieldC||fieldD and splits it into 4 parts named f1, f2, f3 and f4. There are quite a few ways to skin this particular cat, but that is probably the simplest regex way.

I'd suggest spending some time at a regex tutorial site, like perhaps here.
Here's a fun site to play with once you've done a bit of the tutorial.

View solution in original post

SplunkTrust
SplunkTrust

(Edits: sorry, editor kept eating my fields)

One problem is escaping. The pipes | need to be escaped with a preceding \ character.

... | rex field=transaction_type "(?<f1>.*)\|\|(?<f2>.*)\|\|(?<f3>.*)\|\|(?<f4>.*)"

That takes an existing field that is already called "transaction_type" and looks like this: fieldA||fieldB||fieldC||fieldD and splits it into 4 parts named f1, f2, f3 and f4. There are quite a few ways to skin this particular cat, but that is probably the simplest regex way.

I'd suggest spending some time at a regex tutorial site, like perhaps here.
Here's a fun site to play with once you've done a bit of the tutorial.

View solution in original post

Explorer

Thank you! I appreciate it.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!