Splunk Search

RegEx _raw extraction help

kdb8916
Explorer

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:
_raw="2014-02-13 13:02:10,3,VIDEO_STREAMING,CAMERA_6,\"Video has stopped or is intermittent for camera 6='Tool Corral Rear Aisle' on encoder 192.168.2.101.\"

I would like to extract the Camera Name, which in this case is 'Tool Corral Rear Aisle', from the above _raw string.

Can anyone help?

Thanks so much!

Tags (2)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

kdb8916
Explorer

Yes that would be consistent with the other Rex commands I was using ... my apologies for that oversight and I thank you both for your assistance.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

When using the Rex command, the regular expression must be in quotes.

0 Karma

kdb8916
Explorer

That didn't seem to translate correct once I hit the post comment button ... note that I did use the slashes '\' that you suggested in your reply.

0 Karma

kdb8916
Explorer

Thank you for your response.

When I run that code I am getting an error msg - Error in 'SearchParser': Missing a search command before '^'.

The total snippet that I entered in my existing query based on your input was: rex field=_raw (?[^=]+)(?=\son\sencoder)

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...