Splunk Search

regex for extracting word after symbol

deeptha1992
New Member

please help me to extract the quoted word
abcd > efgh > "lmn pqr"

I tried with “(?[^>]$)" but while querying like this
|rex field=_raw “word (?[^>]
$)" showing error.

Thanks in advance

Tags (2)
0 Karma

mydog8it
Builder

I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex:

without a named field--->       |rex field=_raw "\"(.+[^>])\"$"
with a named field --->         |rex field=_raw "\"(?<FieldName>.+[^>])\"$"
0 Karma

DavidHourani
Super Champion

Hi @deeptha1992,

Try this :

|rex field=_raw “([^>]+[>])+\s?\"(?<YourFieldName>.+)\"$"

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...