Splunk Search
Highlighted

Regular Expression to extract the below values

Explorer

Hi, One of my value in table is being passed as an Boolean expression as below

(assignmentgroup = 1213AppDevelopment1 OR assignmentgroup = App-Testing OR assignmentgroup = App Support OR assignmentgroup = App:Support OR assignmentgroup = App&$+*Support assignment_group = AppSupport)

I'm trying to use the | makemv tokenizer= to make the above to be extracted as multivalues as below

1213App_Developmen1
App-Testing
App Support
App:Support
App&$+*Support
AppSupport

And then use mxexpand to appy other table values to the expanded fields.

Can anyone help me with the Regex to do so.

Highlighted

Re: Regular Expression to extract the below values

Legend

Hi @aswin_asok,
please try this regex:

| rex "assignment_group = (?<assignment_group>[^OR]*)"

that you can test at https://regex101.com/r/uKxTe4/1

Ciao.
Giuseppe

0 Karma
Highlighted

Re: Regular Expression to extract the below values

Explorer

Hi @gcusello

Have tried the below,

| rex maxmatch=0 "assignmentgroup\s=\s(?\s[^OR)]+)"

0 Karma
Highlighted

Re: Regular Expression to extract the below values

SplunkTrust
SplunkTrust

Try assignment_group\s=\s([^\s]+).

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Regular Expression to extract the below values

Esteemed Legend

Like this:

|makeresults 
|  eval _raw="(assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR assignment_group = App:Support OR assignment_group = App&$+*Support assignment_group = AppSupport)"
| rex max_match=0 "assignment_group\s*=\s*(?<assignment_group>[^\s\)]+)"

Avoid the use of mvexpand; it does not scale well and will cause false results. All of the *stats commands are multivalue-aware and will do the right thing so just leave it as multivalue.

View solution in original post

Highlighted

Re: Regular Expression to extract the below values

Explorer

Many Thanks @woodcock , extraction is working as expected expect if there is a white space between the values.. included am additional \s.

| rex maxmatch=0 "assignmentgroup\s=\s(?\s[^OR)]+)"