Splunk Search
Highlighted

Regex to extract multiple fields from single event

Path Finder

Hi, I want to extract particular fields from single event based on fields position.

Sample Data:

event1: aaa|bbb|ccc|234| | f5h | |tgvsfj| jhsfj| | | | 6384;
event2: aaa|ggg|hhh|56f| | 563 | |dhr| jhsfj| | | | 6385;

Now, I want to extract 3rd field(i.e ccc) and 7th field(i.e some spaces,nodata)

My data may include spaces.

I need regex to extract those fields only.

Thanks in advance.

0 Karma
Highlighted

Re: Regex to extract multiple fields from single event

Builder

You see each field is a set of characters which is "NOT |" followed by a "|".

| rex "([^\|]*\|){2}(?<thirdField>[^\|]*)\|([^\|]*\|){3}(?<seventhField>[^\|]*)"

Test regular expressions using https://regex101.com/r/Odnybw/1

View solution in original post

0 Karma
Highlighted

Re: Regex to extract multiple fields from single event

Champion

Please check this -
sourcetype=sample | rex field=_raw "^(?:[^\|\n]*\|){2}(?P<string1>\w+)(?:[^ \n]* ){3}\|(?P<string2>\s+)" | table string1 string2 _raw

alt text

0 Karma