Splunk Search
Highlighted

how to extract data after a colon

New Member

example

[dto=forename: "abcforename"
surname: "abcsurname" ..................]

I want to extract the forename and surname ,
and let them combine as a field USER

how?

MANY THX.

0 Karma
Highlighted

Re: how to extract data after a colon

Super Champion

Use a multiline rex.. This will capture everything in the "..".

search.... | rex field=_raw "^\[dto=forename\:\s\"(?<fname>.*)\"\nsurname\:\s\"(?<lastname>.*)\"" | table forename lastname

Another option would be to use props, set your sourcetype with linemerge=false, and define your event boundaries.

0 Karma
Highlighted

Re: how to extract data after a colon

Contributor

You would have to tune the regex to match your requirement but the query would be somewhat like below

.. | rex field=fieldnamehere "dto\=forename\:\s\"(?<fname>\w+)\"\ssurname\:\s\"(?<sname>\w+)\"" | eval merged=fname." ".sname

View solution in original post