Splunk Search

REgex to extract fields

hashsplunk
Loves-to-Learn Lots

AZImaging/Projects/IMG2012002/WSI/D419BC00001/E7004004/SM/96b819b9-fc86-b81b-a999-55a72df0e05a.svs

Hi ,

Above is the string which i want to extract 2 fields . IMG2012002 and  D419BC00001. First value after 2 slashes and second value after 4 slashes . 

How can i write a regular expression for that ? Please help

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
([^\/]+\/){2}(?<first>[^\/]+)\/[^\/]+\/(?<second>[^\/]+)

regex101.com is great for experimenting with regular expressions.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hashsplunk,

please try this regex:

| rex "\w+\/\w+\/(?<field_1>\w+)\/\w+\/(?<field_2>\w+)"

that you can test at https://regex101.com/r/mJvW2M/1

if the string you shared is in a field, you could modify the rex in this way:

| rex field=your_field "^\w+\/\w+\/(?<field_1>\w+)\/\w+\/(?<field_2>\w+)"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...