Splunk Search

Splunk Regex Field Extractions

franciscoz1
Engager

When writing regex, where in the regex string am I supposed to add the (?<new_field>) string ?

I have included a sample regex string below, where in this string would I add (?<new_field>) ?

(?<=\:\[)(.*)(?=\])

Thanks !

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If that is the exact regex and you are talking about using the rex command, then 

 

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

 

will extract the data between the [] into new_field

View solution in original post

franciscoz1
Engager

Worked like a charm, thank you !

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If that is the exact regex and you are talking about using the rex command, then 

 

| rex "(?<new_field>(?<=\:\[)(.*)(?=\]))"

 

will extract the data between the [] into new_field

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...