Splunk Search

Regex to match string between 2 strings?

sasank
Explorer

Hi,

I have below splunk command:

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>.*) and\sThe\ssecond\svalue\sis (?<to>.*)"

 

This shows the "from" field as 0.00 and "to" field as 0","origin":"rep","source_instance":"0"

In the "to" field I only want the value 0. How do I achieve that?

Labels (1)
0 Karma
1 Solution

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

View solution in original post

0 Karma

sasank
Explorer

Thanks for the link. I couldn't figure out how to match the 2nd value so I am looking if someone can help in fixing the regex

0 Karma

PaulPanther
Motivator

@sasank 

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>[^\s]+).+?(?<to>\d)"

0 Karma

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

0 Karma
Get Updates on the Splunk Community!

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...