Splunk Search

Question : I am facing issue in Regular expression want to print substring from string

su_kumar
New Member

Hello Sir ,

I am new for this Regular expression . in our log has different value for field.
want to remove char upto first minus(-) from begining and want to print substing till second minus(-)
Example:
ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE ------------------> AP_Adobe
BLO_CAT_12-DefaultGroup-SH_Auth-DefaultGroup-NONE ------------->DefaultGroup
OTHER-Default-SH_Auth-DefaultGroup-NONE------------------------------->Default

Thanks

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE BLO_CAT_12-DefaultGroup-SH_Auth-DefaultGroup-NONE OTHER-Default-SH_Auth-DefaultGroup-NONE"
| makemv raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "^[^-]+-(?<myDestField>[^-]+)"

NOTE: You may need to change rex on the last line to rex field=mySourceField.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi All.. any ideas/suggestions about how makemv and mvexpand works on this above query please.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

su_kumar
New Member

Thanks .. now it is working.

0 Karma

woodcock
Esteemed Legend

Be sure to UpVote any useful comments or answers and pick the best answer and click Accept to close the question.

0 Karma

saurabhkharkar
Path Finder
try this

| makeresults
| eval string="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE"
| rex field=string ".*?\-(?<output>[^\-]+).+"
| table string output
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...