Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Rex to Exclude + Sign
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I wonder whether someone may be able to help me please.
I'm trying to extract the text "Comapred to previous years almost a pleasure to use" from the raw data as shown below
feedback-comments=Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript
I've tried the following regex, which does extract the text but this includes the '+' sign.
feedback-comments=(?<comments>[^[]+)\&isJavascript
Could someone possibly tell me please how I would be able to write this so the '+' signs are excluded.
Many thanks and kind regards
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the rex command in sed mode. Here's a run anywhere example
|stats c as feedback-comments |eval feedback-comments="Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript"
| rex field="feedback-comments" "(?<comments>[^&]+)" |rex mode=sed field="comments" "s/\+/ /g"
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use the rex command in sed mode. Here's a run anywhere example
|stats c as feedback-comments |eval feedback-comments="Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript"
| rex field="feedback-comments" "(?<comments>[^&]+)" |rex mode=sed field="comments" "s/\+/ /g"
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @gcato thank you for this, but unfortunately this doesn't extract any of the information.
Kind Regards
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gcato's answer works for me. You only need the rex commands in your search. If it's not doing what you expect then please clarify your needs. For instance, to eliminate plus signs instead of replacing them with spaces use rex mode=sed field="comments" "s/\+//g".
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah that was it, thank you for coming back to me with this.
Kind Regards
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your problem is solved, please accept the answer.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi gcato, if you would like to change your comment to an answer I can accept this for you.
Many thanks and kind regards
Chris
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
