Splunk Search

how to extract the required text from the fields using rex

ncbshiva
Communicator

Hi ,

I have a field with VendorName
Example :

HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)

I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279

If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets

output-DLINK-DLINK 500B

Can anyone help me how to write rex command for this..?

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

ncbshiva
Communicator

Thanks for your answer,

i have tried the above rex, i am getting the output as

DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @

but as i told if there are multiple brackets it should consider only the message within the first brackets only.

Required output should be

DLINK-DLINK 500B

Please help me in this...

0 Karma

yannK
Splunk Employee
Splunk Employee

try this one (Tested, it picks only the first parenthesis group)

| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield

It will however extract everything in the parenthesis

HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1

for selective extraction see the answer from @somesoni2

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...