Splunk Search

Regex to extract the end of a string (from a field) before a specific character (starting form the right)

mdeterville
Path Finder

Hi Everyone:

I'd like to extract everything before the first "=" below (starting from the right):

sender=john&uid=johndoe

Note: I will be dealing with varying uid's and string lengths.

Any assistance would be greatly appreciated.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

to4kawa
Ultra Champion

Plan A:

| makeresults
| eval _raw="something_time something  test=foobaa&sender=john&uid=johndoe"
| extract pairdelim="&" kvdelim="="
| eval uid_length=len(uid)

It may not be so easy, I tried to extract from _raw.

Plan B:

| makeresults
| eval your_field="foobaa&sender=john&uid=johndoe"
| eval tmp=mvindex(split(your_field,"&"),mvfind(split(your_field,"&"),"uid"))
| eval uid=mvindex(split(tmp,"="),1)
| eval uid_length=len(uid)

All plans are REGEX-free

0 Karma

woodcock
Esteemed Legend

Even more generic, try this:

| rex "(?<last_word>[^=]+$)"

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

mdeterville
Path Finder

This worked, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...