Splunk Search

Regex to match string between 2 strings?

sasank
Explorer

Hi,

I have below splunk command:

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>.*) and\sThe\ssecond\svalue\sis (?<to>.*)"

 

This shows the "from" field as 0.00 and "to" field as 0","origin":"rep","source_instance":"0"

In the "to" field I only want the value 0. How do I achieve that?

Labels (1)
0 Karma
1 Solution

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

View solution in original post

0 Karma

sasank
Explorer

Thanks for the link. I couldn't figure out how to match the 2nd value so I am looking if someone can help in fixing the regex

0 Karma

PaulPanther
Motivator

@sasank 

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>[^\s]+).+?(?<to>\d)"

0 Karma

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...