Splunk Search

Rex to Extract Specific Word

IRHM73
Motivator

Hi, I wonder whether someone maybe able to help me please.

I'm using the following rex to extract the word ID from a text string, which can be written in many permutations, e.g. ID, Id, id.

| rex field=text "/^|[^a-zA-Z](?<a>(?i)id)[^a-zA-Z]|$"

Could someone tell me please, is there a simpler way to write this?

Many thanks and kind regards

Chris

Tags (2)
0 Karma
1 Solution

493669
Super Champion

Thanks for sample data.

 | rex field=text "\b(?i)(?id)\b"

here \b matches any position that lies at boundary of word "id"
(?i) --> case insensitive match

View solution in original post

0 Karma

micahkemp
Champion

| rex field=text (?<!\w)(?i)(?<a>id)(?!\w)

That looks for the term id not surrounded by other word characters.

0 Karma

493669
Super Champion

Thanks for sample data.

 | rex field=text "\b(?i)(?id)\b"

here \b matches any position that lies at boundary of word "id"
(?i) --> case insensitive match

0 Karma

IRHM73
Motivator

Hi @493669, as per the solution from @wenthold, this works great and thank you for the explanation.

If you change this to an answer I can accept it.

Kind Regards

Chris

0 Karma

wenthold
Communicator

Try

| rex field=text "\b(?i)(?<a>id)\b"
0 Karma

IRHM73
Motivator

Hi @wenthold, this works great, thank you very much for taking the time to put this together.

Many thanks and kind regards

Chris

0 Karma

niketn
Legend

Can you add some sample data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

493669
Super Champion
 | rex field=text "\s(?i)(?<a>id)\s"

it will match word ID(case insensitive) from a text string

0 Karma

IRHM73
Motivator

Hi @493669, thank you for this.

It certainly extracts the correct words in the different formats, but unfortunately if there is a succeeding special character such a s a . or ) it doesn't extract the word.

Many thanks and kind regards

Chris

0 Karma

493669
Super Champion

Can you try below

| rex field=text "\s(?i)(?<a>id)."
0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

I'm sorry this has a similar issue in that it extracts id from the word "identity".

Many thanks and kind regards

Chris

0 Karma

IRHM73
Motivator

If it helps, here is sample data where id should not be extracted:

The first part of registration was
straight forward but I have been left
confused as to if the process was
completed or not ? when I tried to
continue the system did not recognise
my identity ?

Regards

Chris

0 Karma

DalJeanis
Legend

This will place any single combination of ( ID, iD, Id, or id) that is found in field text into field a, if that is what you want.

 | rex field=text "(?i)(?<a>id)"
0 Karma

IRHM73
Motivator

Hi, thank you for this @DalJeanis, but unfortunately it doesn't quite work because it extracts the id from words such as "said".

Many thanks and kind regards

Chris

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...