Splunk Search

Regex to extract the end of a string (from a field) before a specific character (starting form the right)

mdeterville
Path Finder

Hi Everyone:

I'd like to extract everything before the first "=" below (starting from the right):

sender=john&uid=johndoe

Note: I will be dealing with varying uid's and string lengths.

Any assistance would be greatly appreciated.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

to4kawa
Ultra Champion

Plan A:

| makeresults
| eval _raw="something_time something  test=foobaa&sender=john&uid=johndoe"
| extract pairdelim="&" kvdelim="="
| eval uid_length=len(uid)

It may not be so easy, I tried to extract from _raw.

Plan B:

| makeresults
| eval your_field="foobaa&sender=john&uid=johndoe"
| eval tmp=mvindex(split(your_field,"&"),mvfind(split(your_field,"&"),"uid"))
| eval uid=mvindex(split(tmp,"="),1)
| eval uid_length=len(uid)

All plans are REGEX-free

0 Karma

woodcock
Esteemed Legend

Even more generic, try this:

| rex "(?<last_word>[^=]+$)"

richgalloway
SplunkTrust
SplunkTrust

Regular expressions work left-to-right so what you want is everything after the last "=". Or is it more precise to say you want the UID string? If the latter, try this:

| rex "&uid=(?<uid>.*)"
---
If this reply helps you, Karma would be appreciated.

mdeterville
Path Finder

This worked, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...