Splunk Search

RegEx Extraction Assistance for new field.

Explorer

I have a field that looks like the below.

PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)

Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)

I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"

PMGroup=Build VZT
PMGroup=Run

Any help would be appreciated.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Explorer

This worked perfect but for some reason I had to add field=PM for it to extract properly.

| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

SplunkTrust
SplunkTrust

Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma