Splunk Search

Regex to extract a field between 2 fixed words

marellasunil
Communicator

Hi,
I am having events,
Number1=ABCDAS Number2=10
Number1=hsd gdsf Number2=1
Number1=ADG FHK Number2=11
Number1=HGSF Number2=4

I would like to extract the field value of Number1, Field value does not displaying any value after space in Splunk fields.
Probably regex will help to extract ABCDAS, hsd gdsf, ADG FHK, HGSF
Could anybody help to extract?
Number1 & Number2 are constant fields...

Tags (2)
0 Karma
1 Solution

grijhwani
Motivator

Your question is not at all clear, presumably because English is not your first language, but as I understand it you are specifically referring to cases 2 and 3 in your example, where you have embedded spaces in the field value. Have you tried redefining the field using the interactive field extractor?

To extract interactively using a manual search you need something like the following to extract to a field name that you can then use:

 {search} | rex "Number1=(?<yourfield>.*) +Number2="

View solution in original post

grijhwani
Motivator

Your question is not at all clear, presumably because English is not your first language, but as I understand it you are specifically referring to cases 2 and 3 in your example, where you have embedded spaces in the field value. Have you tried redefining the field using the interactive field extractor?

To extract interactively using a manual search you need something like the following to extract to a field name that you can then use:

 {search} | rex "Number1=(?<yourfield>.*) +Number2="

marellasunil
Communicator

This is awesome, working exactly what I expected, Thank you very much grijhwani...

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...