Splunk Search

Regex certain value from a field

timyong80
Explorer

Hello,

I have a regex question. I have a field called "Container" and below are the examples of the values.
I would like to regex a certain part of the value but unfortunately, there's no unique marker to tell it where to start/stop. However, I noticed that there's always 3 underscores before that specific part that I need to extract so probably that could be helpful for the regex.

Can you help me with the regex expression (starts after the 3rd underscore and ends before the next underscore)?

1) k8s_jenkins_jenkins-16-mrlz4_tau-ops_eb099c1d-6d70-11ea-8ba8-001a4a160104_0
2) k8s_datadog-agent_datadog-agent-t4dlc_clusteradmin_dd5f238b-6a16-11ea-8ef9-566f4e1c0167_351
3) k8s_core-order-service_core-order-service-deployment-1-t9b29_fltc-ods-uit_b10cf94d-64b1-11ea-8ef9-566f4e1c0167_3513

Desired regex result for Container field:

1) tau-ops
2) clusteradmin
3) fltc-ods-uit

Thank you in advance.

Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi @timyong80,
please try something like this:

index=your_index
| rex "^([^_]+_){3}(?<field>[^_]+)_"
| ...

that you can test at https://regex101.com/r/CCGPg6/1

Ciao.
Giuseppe

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval Container="k8s_jenkins_jenkins-16-mrlz4_tau-ops_eb099c1d-6d70-11ea-8ba8-001a4a160104_0,
 k8s_datadog-agent_datadog-agent-t4dlc_clusteradmin_dd5f238b-6a16-11ea-8ef9-566f4e1c0167_351,
 k8s_core-order-service_core-order-service-deployment-1-t9b29_fltc-ods-uit_b10cf94d-64b1-11ea-8ef9-566f4e1c0167_3513" 
| makemv delim="," Container 
| mvexpand Container 
| eval result = mvindex(split(Container,"_"),3) 
| table Container,result
0 Karma

timyong80
Explorer

Thank you! These are 3 separate entries actually., not in one field separated by comma.
But I learned new thing about makemv delim function. Thanks again!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works with your sample data.

| rex field=Container "(?:[^_]+_){3}(?<field>[^_]+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

timyong80
Explorer

Thanks a bunch, really appreciate it. This works well!

0 Karma

gcusello
Legend

Hi @timyong80,
please try something like this:

index=your_index
| rex "^([^_]+_){3}(?<field>[^_]+)_"
| ...

that you can test at https://regex101.com/r/CCGPg6/1

Ciao.
Giuseppe

0 Karma

timyong80
Explorer

Thanks a lot 🙂 This works!

0 Karma

gcusello
Legend

Hi @timyong80,
you're welcome!
Ciao and next time!
Giuseppe

0 Karma

vnguyen46
Contributor

Hi,

How can I regex <Type> Read Only </Type> to get "Read Only"? I mean only yield text between the tags.

Thanks,

0 Karma

jpolvino
Builder

Here is one way to do it, using a Run Anywhere SPL:

| makeresults
| eval _raw="event
k8s_jenkins_jenkins-16-mrlz4_tau-ops_eb099c1d-6d70-11ea-8ba8-001a4a160104_0
k8s_datadog-agent_datadog-agent-t4dlc_clusteradmin_dd5f238b-6a16-11ea-8ef9-566f4e1c0167_351
k8s_core-order-service_core-order-service-deployment-1-t9b29_fltc-ods-uit_b10cf94d-64b1-11ea-8ef9-566f4e1c0167_3513"
| multikv forceheader=1 | fields _raw
| rex "(.*?_){3}(?<container>[^_]+)"

See regex101

0 Karma

timyong80
Explorer

Excellent, I used the rex part only and it works!
Thank you very much

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...