Splunk Search

Trying to create a custom Field Extraction

scout29
Path Finder

I am trying to write a regex to extract a field called "registrar" from some data like i have below. Can you please help how i could write this regex to be used in a rex command to extract the field? Below are three example events:


Registry Date: 2025-10-08T15:18:58Z   Registrar: ABC Holdings, Inc.   Registrar ID: 291  Server Name: AD12

Registry Date: 2025-11-08T15:11:58Z   Registrar: OneTeam, Inc.   Registrar ID: 235  Server Name: AD17

Registry Date: 2025-12-08T15:10:58Z   Registrar: appit.com, LLC   Registrar ID: 257  Server Name: AD14

 

I need the regex to use to extract the field called "registrar"  which in the above example would have the following three value matches:  

ABC Holdings, Inc. 

OneTeam, Inc

appit.com, LLC

 

 

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming the fields are always in the same order, this should do it.

| rex "Registrar: (?<registrar>.*?) Registar ID"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assuming the fields are always in the same order, this should do it.

| rex "Registrar: (?<registrar>.*?) Registar ID"
---
If this reply helps you, Karma would be appreciated.

m_pham
Splunk Employee
Splunk Employee

Try adding this to your search

| rex field=_raw "Registrar ID: (?<registrar_id>\S+)" 

Update: I misread your post, standby for an updated search to include all three field extraction - unless someone else beat me to it. You can also use the "Extract New Fields" or "Event Actions" option when you run your search.

0 Karma

scout29
Path Finder

i am looking for the field registrar to be extracted. There are three spaces after the registrar string - but i cant seem to write my regex to capture the full registrar name up to the three spaces. I am using this but not getting the full string extracted 

\sRegistrar:\s(?<registrar>\w+\s\w+)

 

Tags (1)
0 Karma

m_pham
Splunk Employee
Splunk Employee

Try this - I'm not the best at regex and someone else may come along and provide a more efficient one.

 

Registrar: (?<registrar>.+[^\s]).+Registrar ID   

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...