Splunk Search

Trying to create a custom Field Extraction

scout29
Explorer

I am trying to write a regex to extract a field called "registrar" from some data like i have below. Can you please help how i could write this regex to be used in a rex command to extract the field? Below are three example events:


Registry Date: 2025-10-08T15:18:58Z   Registrar: ABC Holdings, Inc.   Registrar ID: 291  Server Name: AD12

Registry Date: 2025-11-08T15:11:58Z   Registrar: OneTeam, Inc.   Registrar ID: 235  Server Name: AD17

Registry Date: 2025-12-08T15:10:58Z   Registrar: appit.com, LLC   Registrar ID: 257  Server Name: AD14

 

I need the regex to use to extract the field called "registrar"  which in the above example would have the following three value matches:  

ABC Holdings, Inc. 

OneTeam, Inc

appit.com, LLC

 

 

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming the fields are always in the same order, this should do it.

| rex "Registrar: (?<registrar>.*?) Registar ID"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assuming the fields are always in the same order, this should do it.

| rex "Registrar: (?<registrar>.*?) Registar ID"
---
If this reply helps you, Karma would be appreciated.

m_pham
Splunk Employee
Splunk Employee

Try adding this to your search

| rex field=_raw "Registrar ID: (?<registrar_id>\S+)" 

Update: I misread your post, standby for an updated search to include all three field extraction - unless someone else beat me to it. You can also use the "Extract New Fields" or "Event Actions" option when you run your search.

0 Karma

scout29
Explorer

i am looking for the field registrar to be extracted. There are three spaces after the registrar string - but i cant seem to write my regex to capture the full registrar name up to the three spaces. I am using this but not getting the full string extracted 

\sRegistrar:\s(?<registrar>\w+\s\w+)

 

Tags (1)
0 Karma

m_pham
Splunk Employee
Splunk Employee

Try this - I'm not the best at regex and someone else may come along and provide a more efficient one.

 

Registrar: (?<registrar>.+[^\s]).+Registrar ID   

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...