Splunk Search

What is the regex needed to extract the field "FileImported" field format?

griffinpair
Path Finder

I have the following Field named FileImported that is formatted the following way:

text_text_NEEDED EXTRACTION_text

An example of FileImported is:

22_ABC_FileID1564_Export

And I want "FileID1564" as a field named "Export" from the existing Fileimported field.

I have attempted Regex myself, but am not as experienced in it to get it working. What would be the regex needed to extract what I need based on the FileImported field format?

0 Karma

mayurr98
Super Champion

hey try this run anywhere search

| makeresults 
| eval FileImported="22_ABC_FileID1564_Export sds_ABCsds_FileID15sdsd64_Export1ww" 
| makemv FileImported 
| mvexpand FileImported 
| rex field=FileImported ".*_(?<Export>\w+)[-_]"

In your environment, you should write

<base_Search>| rex field=FileImported ".*_(?<Export>\w+)[-_]"

let me know if this helps!

richgalloway
SplunkTrust
SplunkTrust

Try this.

... | rex field=FileImported "(?:\w+_){2}(?<Export>[^_]+)_" | ...

BTW, regex101.com is a great site for testing regex extractions.

---
If this reply helps you, Karma would be appreciated.

493669
Super Champion

Hi @griffinpair,
Try this regex:

...|rex field=FileImported "([^_]+_){2}(?<Export>[^_]+)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...