Splunk Search

Regex to split field, optional second field

pgreer_splunk
Splunk Employee
Splunk Employee

I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'

For example:

field1
field1:field2
field1
...

I've tried

(?<myfield1>.*):(?<myfield2>.*)

but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

View solution in original post

0 Karma

gokadroid
Motivator

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

That seems to have done it.

So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".

That seems to have done it for me. Thanks!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...