Hi ,
I am new in splunk, i need to find some letter from text using Reg: ex.
how i can do.
i have to find text after Channel , (BLACKROCK) only i dont want to find other text
and this text can chnage, i only know after channel and before trader??
i am using this , but taking every thing after BlackRock ,rex field=_raw "channel (?.*)"
channel BLACKROCK** trader null, new version is 4 new status is Timed Out (Client)
Try something like this
your base search | rex "channel (?<YourField>\w+)"
OR
your base search | rex "channel (?<YourField>\S+)"
OR
your base search | rex "channel (?<YourField>[^\s]+)"
Update
For multiple fields (assuming status is complete string from "new status is " to the end)
your base search | rex "channel (?<YourField>\S+)([^,]+), new version is (?<version>\S+) new status is (?<status>.*)"
Try something like this
your base search | rex "channel (?<YourField>\w+)"
OR
your base search | rex "channel (?<YourField>\S+)"
OR
your base search | rex "channel (?<YourField>[^\s]+)"
Update
For multiple fields (assuming status is complete string from "new status is " to the end)
your base search | rex "channel (?<YourField>\S+)([^,]+), new version is (?<version>\S+) new status is (?<status>.*)"
Nice cool, how we can do multiple field.
rex field=_raw "channel (?\S+) new status is (?.*) "