Splunk Search

REGEX Help

joesrepsolc
Communicator

Trying to pull the value from the 2nd set of brackets [ ] from this log. Some of the data values are blank, some start with a "/" and some are just text/numbers. Struggling to set regex to get the value between the brackets, regardless of what data is in there.

HELP? Thank You!

2019-10-14 10:25:30,860 [0.16.132.114:8443-78] [/microdc_1]
2019-10-14 10:25:30,854 [0.16.132.114:8443-78] [/microdc_1]
2019-10-14 10:25:30,813 [0.16.132.114:8443-78] [/microdc_1]
2019-10-14 10:25:30,526 [10.16.142.94:8443-75] [TABTHREAD1]
2019-10-14 10:25:30,514 [.16.132.111:8443-146] [/microdc_1]
2019-10-14 10:25:30,467 [.16.136.140:8443-123] [/microdc_2]
2019-10-14 10:25:30,466 [.16.136.140:8443-123] [/microdc_2]
2019-10-14 10:25:30,103 [.16.132.111:8443-146] [/microdc_1]
2019-10-14 10:25:30,097 [.16.132.111:8443-146] [/microdc_1]
2019-10-14 10:25:30,078 [.16.132.111:8443-146] [/microdc_1]
2019-10-14 10:25:29,888 [.16.134.114:8443-128] [/microdc_1]
2019-10-14 10:25:29,883 [.16.134.114:8443-128] [/microdc_1]
2019-10-14 10:25:29,865 [.16.134.114:8443-128] [/microdc_1]
2019-10-14 10:25:29,638 [0.16.130.100:8443-71] [TABTHREAD1]
2019-10-14 10:25:29,594 [10.16.142.97:8443-80] [TABTHREAD2]
2019-10-14 10:25:29,594 [10.16.142.97:8443-80] [TABTHREAD2]
2019-10-14 10:25:29,502 [.16.130.104:8443-144] [TABTHREAD1]
2019-10-14 10:25:29,462 [0.16.134.106:8443-59] [          ]
2019-10-14 10:25:29,337 [0.16.130.100:8443-47] [TABTHREAD1]
2019-10-14 10:25:29,270 [0.16.134.106:8443-59] [TABTHREAD1]
0 Karma

Anantha123
Communicator

Try this

]\s(\[\/|\[)(?<test>[^\]]+)]

Thanks
Anantha.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
try this regex

^[^\]]*\]\s+\[(?<my_field>[^\]]*)

that you can test at https://regex101.com/r/GCtXSM/1/

Ciao.
Giuseppe

0 Karma

mayurr98
Super Champion

try this :

<your_index> | rex field=_raw "\-\d+\]\s+\[(?<Field>[^\]]+)\]"

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...