Splunk Search

Splunk Regex Field Extractions

franciscoz1
Engager

When writing regex, where in the regex string am I supposed to add the (?<new_field>) string ?

I have included a sample regex string below, where in this string would I add (?<new_field>) ?

(?<=\:\[)(.*)(?=\])

Thanks !

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If that is the exact regex and you are talking about using the rex command, then 

 

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

 

will extract the data between the [] into new_field

View solution in original post

franciscoz1
Engager

Worked like a charm, thank you !

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If that is the exact regex and you are talking about using the rex command, then 

 

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

 

will extract the data between the [] into new_field

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...