Splunk Search

how to extract the required text from the fields using rex

ncbshiva
Communicator

Hi ,

I have a field with VendorName
Example :

HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)

I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279

If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets

output-DLINK-DLINK 500B

Can anyone help me how to write rex command for this..?

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

ncbshiva
Communicator

Thanks for your answer,

i have tried the above rex, i am getting the output as

DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @

but as i told if there are multiple brackets it should consider only the message within the first brackets only.

Required output should be

DLINK-DLINK 500B

Please help me in this...

0 Karma

yannK
Splunk Employee
Splunk Employee

try this one (Tested, it picks only the first parenthesis group)

| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield

It will however extract everything in the parenthesis

HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1

for selective extraction see the answer from @somesoni2

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...