Splunk Search

Question : I am facing issue in Regular expression want to print substring from string

su_kumar
New Member

Hello Sir ,

I am new for this Regular expression . in our log has different value for field.
want to remove char upto first minus(-) from begining and want to print substing till second minus(-)
Example:
ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE ------------------> AP_Adobe
BLO_CAT_12-DefaultGroup-SH_Auth-DefaultGroup-NONE ------------->DefaultGroup
OTHER-Default-SH_Auth-DefaultGroup-NONE------------------------------->Default

Thanks

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE BLO_CAT_12-DefaultGroup-SH_Auth-DefaultGroup-NONE OTHER-Default-SH_Auth-DefaultGroup-NONE"
| makemv raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "^[^-]+-(?<myDestField>[^-]+)"

NOTE: You may need to change rex on the last line to rex field=mySourceField.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi All.. any ideas/suggestions about how makemv and mvexpand works on this above query please.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

su_kumar
New Member

Thanks .. now it is working.

0 Karma

woodcock
Esteemed Legend

Be sure to UpVote any useful comments or answers and pick the best answer and click Accept to close the question.

0 Karma

saurabhkharkar
Path Finder
try this

| makeresults
| eval string="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE"
| rex field=string ".*?\-(?<output>[^\-]+).+"
| table string output
0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...