Splunk Search

Rex command for extracting data from a variable

Marco
Communicator

Good Morning,

I am currently trying to extract a field from  a variable.

The variable name is command, and the value the command holds is 

Command = "CONNECT SPLNKUSER GROUP(QA)"

What I'm trying to do is extract the QA part and create a new variable called group.

For example:

Group = QA

Group= Accounting

Group = Payroll

 

Thank you,

Marco

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

| rex field=Command "\((?<group>[^\)]+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

| rex field=Command "\((?<group>[^\)]+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...