Splunk Search

Regex Field Extraction in Data Model


Hi all. I'm fairly new to Splunk and regex. I've got many event logs and I'm making use of data models beforing generating different visualisations.


The fields discovered isn't good enough for my usecase thus I need to extract specific fields. Right now, using the following regex




, I'm able to extract this pattern 




most accurately. 

Subsequently, I would like extract each respective word into its own field. In total 3 different fields for ABC, DEF and GHI respectively.

Is there a way I extract each individual word? How can perform regex expression on top of my current regex expression result? Thank you.

Labels (1)
0 Karma



excellent place to check and training with your regex is regex101.com. In there you could try with visual feedback how those are working.

To separate those to own variables can be do at least next ways.

... base search ... 
| rex "(?<field 1>[rex for field one])...(?<f2>[rex for f2])...(?<f3>[rex for f3])"


... base search ... 
| rex "(?<field 1>[rex for field one])"
| rex "(?<f2>[rex for f2])" 
| rex "(?<f3>[rex for f3])"

 But which one is better for you? As usually it depends on what your events are. Are those always in same order   and all in place (then probably first one is better). Or can order be different and are those all present? In this case probably second one is better. Of course in second one you must separate those events from each other to get values to correct field name. For that reason you must add some additional strings etc. to those rex to match to the correct part of event.

And one option to use is add those extractions to props.conf and transforms.com especially when you need those in several queries.

Two other commands which can help you https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Extract and https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Erex

r. Ismo

0 Karma


Hey @isoutamo. Thanks for the suggestion. However, my question is specific to forming the regex expression in the Regular Expression box within "App/Search/data_model_editor" of Splunk, and not about forming a search query as you've suggested.

Screen Shot 2022-01-10 at 11.08.00 PM.png

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...