- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- need help in extracting a substring from a string
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello splunkers! new to splunk and i am needing to extract a word from a message field.
this is the message
The Cluster Service service entered the running state.
i want to extract "running state" and use it to indicate a status of a server.
thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pipe your existing search to erex, give the field a name and provide an example.
...| erex ServiceState examples="running state"
When your search completes use the job inspector to find the regex that Splunk used to find your match.
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pipe your existing search to erex, give the field a name and provide an example.
...| erex ServiceState examples="running state"
When your search completes use the job inspector to find the regex that Splunk used to find your match.
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this worked great!!!!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it worked for you! erex is a hidden gem 🙂
An upvote would be appreciated and Accept Solution if it helps!
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
