Splunk Search

Writing rex to grep a value from the field

I have 3 different values to be extracted. Please help me in writing rex command

here is the field values
name="ascd23:deo"
name="adcs44.sys.com"
name="aswdc-w.foul.com"

I need values as below
name=ascd23
name=adcs44
name=aswdc-w
I need a rex command

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

So... everything before the first dot or colon, not including quotes?

If you already have the name field key-value-extracted, try this:

... | rex field=name "^(?<name>[^.:]+)"

If you don't already have the name field, try this:

... | rex "name=\"(?<name>[^.:\"]+)"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

So... everything before the first dot or colon, not including quotes?

If you already have the name field key-value-extracted, try this:

... | rex field=name "^(?<name>[^.:]+)"

If you don't already have the name field, try this:

... | rex "name=\"(?<name>[^.:\"]+)"

View solution in original post

0 Karma