Splunk Search

how to extract the required text from the fields using rex

ncbshiva
Communicator

Hi ,

I have a field with VendorName
Example :

HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)

I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279

If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets

output-DLINK-DLINK 500B

Can anyone help me how to write rex command for this..?

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

View solution in original post

somesoni2
Revered Legend

Try this

your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"

This takes care of multiple message in the field as well.

ncbshiva
Communicator

Thanks for your answer,

i have tried the above rex, i am getting the output as

DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @

but as i told if there are multiple brackets it should consider only the message within the first brackets only.

Required output should be

DLINK-DLINK 500B

Please help me in this...

0 Karma

yannK
Splunk Employee
Splunk Employee

try this one (Tested, it picks only the first parenthesis group)

| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield

It will however extract everything in the parenthesis

HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1

for selective extraction see the answer from @somesoni2

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...