Splunk Search

regex for extracting word after symbol

deeptha1992
New Member

please help me to extract the quoted word
abcd > efgh > "lmn pqr"

I tried with “(?[^>]$)" but while querying like this
|rex field=_raw “word (?[^>]
$)" showing error.

Thanks in advance

Tags (2)
0 Karma

mydog8it
Builder

I noticed the quotes in your regex are two different characters, the first pair do not match the text. Here is a suggestion that closely matches your regex:

without a named field--->       |rex field=_raw "\"(.+[^>])\"$"
with a named field --->         |rex field=_raw "\"(?<FieldName>.+[^>])\"$"
0 Karma

DavidHourani
Super Champion

Hi @deeptha1992,

Try this :

|rex field=_raw “([^>]+[>])+\s?\"(?<YourFieldName>.+)\"$"

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...