Splunk Search

Rex to match fields until particular string

slipinski
Explorer

Hi,

I'm using expression: (?ms)book.(?\d{7}-\d) to extract some numbers from this input (thanks @to4kawa ) :

" new contributors: Set(book.1272473-1, book.1272472-1, book.1272477-1), removed contributors: Set(book.1271398-1, book.1271397-1)".

This gives me all 5 numbers (1272473, 1272472, 1272477, 1271398, 1271397), but I'm interested only in numbers before keyword "removed" (1272473, 1272472, 1272477). Please bear in mind, there could be from 1 to 5 strings in "new contribution" section and I would like to extract all of them.

Thanks is advance,
Szymon

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

UPDATE:
use 2 rex

| makeresults 
| eval _raw="new contributors: Set(book.1272473-1, book.1272472-1, book.1272477-1), removed contributors: Set(book.1271398-1, book.1271397-1)" 
| rex "(?<new>.*), removed" 
| rex field=new max_match=0 "(?ms)book.(?<book>\d{7}-\d)"

View solution in original post

to4kawa
Ultra Champion

UPDATE:
use 2 rex

| makeresults 
| eval _raw="new contributors: Set(book.1272473-1, book.1272472-1, book.1272477-1), removed contributors: Set(book.1271398-1, book.1271397-1)" 
| rex "(?<new>.*), removed" 
| rex field=new max_match=0 "(?ms)book.(?<book>\d{7}-\d)"

slipinski
Explorer

Correct me if I'm wrong, but your query will extract fields after "removed" string and I would like to extract fields before it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...