Splunk Search

Regex help!

Communicator

Hello All,

Need assistance in regex creation.

I want to remove every thing before an character.

Example:

/REGISTRY/MACHINE/Software/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/{B4F3A835-0E21-4959-BA22-42B3008E02FF}

Want to remove every thing before "{"

And expecting the result as
{B4F3A835-0E21-4959-BA22-42B3008E02FF}

Thanks in advance.

Regards
..............SS

Tags (2)
0 Karma
1 Solution

Revered Legend

In line in search you can do like this

your current search which include the fieldInFocus
| rex field=fieldInFocus mode=sed "s/^([^\{]+)(.+)/\2/g"

OR

your current search which include the fieldInFocus
| eval fieldInFocus=replace(fieldInFocus,"([^\{]+)","")

View solution in original post

Revered Legend

In line in search you can do like this

your current search which include the fieldInFocus
| rex field=fieldInFocus mode=sed "s/^([^\{]+)(.+)/\2/g"

OR

your current search which include the fieldInFocus
| eval fieldInFocus=replace(fieldInFocus,"([^\{]+)","")

View solution in original post

Communicator

Thanks Soni ,

| rex field=fieldInFocus mode=sed "s/^([^{]+)(.+)/\2/g"

Work as expected 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!