Splunk Search

Regex : Extract text between first and second semi-colon from the right

mdeterville
Path Finder

Hello SMEs:

I need some assistance extracting everything between the 1st and 2nd semi-colon ; (FROM THE RIGHT)  from a string like this: SITES;Bypass;Whitelist;Finance;User Business Accept

In this case, the output would be Finance.

Note: text between the semi-colon's may change 

Any assistance would be appreciated.

Regards,

Mac

Labels (1)
0 Karma
1 Solution

tscroggins
Champion

@mdeterville 

The * quantifier is greedy by default. This should work:

| rex ".*;(?<value>.*);"

Try it here.

View solution in original post

mdeterville
Path Finder

@tscroggins  Ran into an issue where the data set also includes some categories only contains 1 Semi colon, similar to: "Business/Economy;User Accepted Business".

Any idea if OR conditions can be used to combine the initial solution and another solution that grabs everything before the first semi-colon (FROM THE LEFT) when it finds fields with only one semi colon?

Thanks in advance.

-Mac

0 Karma

tscroggins
Champion

@mdeterville

There are many (infinite!) ways to construct regular expressions. To capture everything between the first semicolon and either the second semicolon or the end of the line, you can use e.g.:

| rex ".*?;(?<value>[^;$]+);?"

$ is an anchor (a special token) representing the end of the string. The construct [^;$]+ means one or more characters not matching semicolon or end of string. The capture will stop when it encounters either of those characters.

You can plug the regular expression into regex101.com or another tool to test it with a step by step explanation.

0 Karma

tscroggins
Champion

@mdeterville 

The * quantifier is greedy by default. This should work:

| rex ".*;(?<value>.*);"

Try it here.

mdeterville
Path Finder

@tscroggins Worked like a charm - Thanks for the quick response!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...