Splunk Search

regex to match everything between the 25th and 130th characters in a line

mritenburg
New Member

Hello,

I am trying to craft a regex to match everything between the 25th and 130th character in a line. I am having no success. Someone suggested ^.{25} (?P<FIELDNAME>.{130} but that doesn't work at all. Does anyone know how to create this regex?

Thank you!

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

View solution in original post

rtadams89
Contributor

Depending on what you are trying to accomplish, you may be better off using the eval substr() function. For example:

... | eval newField=substr(field, 26, 104)

Otherwise, you can use this regex to extract the same thing:

^.{25}(?P<newField>.{0,105})
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

mritenburg
New Member

This works perfectly ^.{25}(?P.{1,105}).

Thank you!

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...