Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex formating help
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone help me format a regular expression for Splunk?
I can create the regular expression using regexr.com and I have 2 non-capturing groups and a capturing group, but I am not sure how to format the regular expression for splunk.
Any tips or help you can provide is appreciated.
Here is my string:
string1="First Name (DEPT-User) account provisioned"
And the regex:
(:?string1=")([A-Za-z0-9() -]+)(:?account provisioned")
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your data contain string1="First Name (DEPT-User) account provisioned"? Ideally Splunk should have automatically identified this as key value pair during search time. Which implies you would need to create field extraction/rex on string1. Have you checked Interesting Fields in Verbose mode whether string1 field is already available or not? Which is the field you want to extract?
If you want to extract First Name (DEPT-User), following rex should work:
<YourBaseSearch>
| rex field=_raw "string1=\"(?<Data>[^\)]+\)) account provisioned\""
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does your data contain string1="First Name (DEPT-User) account provisioned"? Ideally Splunk should have automatically identified this as key value pair during search time. Which implies you would need to create field extraction/rex on string1. Have you checked Interesting Fields in Verbose mode whether string1 field is already available or not? Which is the field you want to extract?
If you want to extract First Name (DEPT-User), following rex should work:
<YourBaseSearch>
| rex field=_raw "string1=\"(?<Data>[^\)]+\)) account provisioned\""
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@AHEARNJ, I have converted comment to answer. Please accept to mark as answered!
| makeresults | eval message= "Happy Splunking!!!"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Mile High Learning with Splunk University, Denver, Colorado
IT Service Intelligence 5.0 Series: Your Guide to the June Launch
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
