Splunk Search

how to extract the required text from the fields using rex

ncbshiva
Communicator

Hi ,

I have a field with VendorName
Example :

HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)

I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279

If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets

output-DLINK-DLINK 500B

Can anyone help me how to write rex command for this..?

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

ncbshiva
Communicator

Thanks for your answer,

i have tried the above rex, i am getting the output as

DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @

but as i told if there are multiple brackets it should consider only the message within the first brackets only.

Required output should be

DLINK-DLINK 500B

Please help me in this...

0 Karma

yannK
Splunk Employee
Splunk Employee

try this one (Tested, it picks only the first parenthesis group)

| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield

It will however extract everything in the parenthesis

HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1

for selective extraction see the answer from @somesoni2

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!