Splunk Search

RegEx Extraction Assistance for new field.

matt4321
Explorer

I have a field that looks like the below.

PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)

Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)

I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"

PMGroup=Build VZT
PMGroup=Run

Any help would be appreciated.

Tags (2)
0 Karma
1 Solution

niketn
Legend

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

matt4321
Explorer

This worked perfect but for some reason I had to add field=PM for it to extract properly.

| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

niketn
Legend

Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...