Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: RegEx Extraction Assistance for new field.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a field that looks like the below.
PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)
Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)
I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"
PMGroup=Build VZT
PMGroup=Run
Any help would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try the following rex command
<YourBaseSearch>
| rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try the following rex command
<YourBaseSearch>
| rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked perfect but for some reason I had to add field=PM for it to extract properly.
| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.
| makeresults | eval message= "Happy Splunking!!!"
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
