Splunk Search

Regex to match string between 2 strings?

sasank
Explorer

Hi,

I have below splunk command:

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>.*) and\sThe\ssecond\svalue\sis (?<to>.*)"

 

This shows the "from" field as 0.00 and "to" field as 0","origin":"rep","source_instance":"0"

In the "to" field I only want the value 0. How do I achieve that?

Labels (1)
0 Karma
1 Solution

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

View solution in original post

0 Karma

sasank
Explorer

Thanks for the link. I couldn't figure out how to match the 2nd value so I am looking if someone can help in fixing the regex

0 Karma

PaulPanther
Motivator

@sasank 

| makeresults
| eval _raw="The first value is 0.00 and The second value is 0\",\"origin\":\"rep\",\"source_instance\":\"0\""
| rex "The\sfirst\svalue\sis (?<from>[^\s]+).+?(?<to>\d)"

0 Karma

PaulPanther
Motivator

@sasank Test your regex in a regex editor like

https://regex101.com/r/1oqLAF/3 

If you follow the link you will find your test string and a regex that you can use to match the correct values.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...