Splunk Search
Highlighted

Question : I am facing issue in Regular expression want to print substring from string

New Member

Hello Sir ,

I am new for this Regular expression . in our log has different value for field.
want to remove char upto first minus(-) from begining and want to print substing till second minus(-)
Example:
ALLCAT12-APAdobe-AdobeIdent-Defaultgp-NONE ------------------> APAdobe
BLO
CAT12-DefaultGroup-SHAuth-DefaultGroup-NONE ------------->DefaultGroup
OTHER-Default-SH_Auth-DefaultGroup-NONE------------------------------->Default

Thanks

0 Karma
Highlighted

Re: Question : I am facing issue in Regular expression want to print substring from string

Path Finder
try this

| makeresults
| eval string="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE"
| rex field=string ".*?\-(?<output>[^\-]+).+"
| table string output
0 Karma
Highlighted

Re: Question : I am facing issue in Regular expression want to print substring from string

Esteemed Legend

Like this:

| makeresults 
| eval raw="ALL_CAT_12-AP_Adobe-Adobe_Ident-Defaultgp-NONE BLO_CAT_12-DefaultGroup-SH_Auth-DefaultGroup-NONE OTHER-Default-SH_Auth-DefaultGroup-NONE"
| makemv raw
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "^[^-]+-(?<myDestField>[^-]+)"

NOTE: You may need to change rex on the last line to rex field=mySourceField.

0 Karma
Highlighted

Re: Question : I am facing issue in Regular expression want to print substring from string

New Member

Thanks .. now it is working.

0 Karma
Highlighted

Re: Question : I am facing issue in Regular expression want to print substring from string

Esteemed Legend

Be sure to UpVote any useful comments or answers and pick the best answer and click Accept to close the question.

0 Karma
Highlighted

Re: Question : I am facing issue in Regular expression want to print substring from string

Champion

Hi All.. any ideas/suggestions about how makemv and mvexpand works on this above query please.

0 Karma