Splunk Search

how to extract the required text from the fields using rex

ncbshiva
Communicator

Hi ,

I have a field with VendorName
Example :

HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)

I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279

If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets

output-DLINK-DLINK 500B

Can anyone help me how to write rex command for this..?

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

ncbshiva
Communicator

Thanks for your answer,

i have tried the above rex, i am getting the output as

DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @

but as i told if there are multiple brackets it should consider only the message within the first brackets only.

Required output should be

DLINK-DLINK 500B

Please help me in this...

0 Karma

yannK
Splunk Employee
Splunk Employee

try this one (Tested, it picks only the first parenthesis group)

| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield

It will however extract everything in the parenthesis

HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1

for selective extraction see the answer from @somesoni2

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...