Splunk Search

Regex to split field, optional second field

Splunk Employee
Splunk Employee

I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'

For example:

field1
field1:field2
field1
...

I've tried

(?<myfield1>.*):(?<myfield2>.*)

but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?

Tags (1)
0 Karma
1 Solution

Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

View solution in original post

0 Karma

Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

That seems to have done it.

So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".

That seems to have done it for me. Thanks!