Splunk Search

regex to match everything between the 25th and 130th characters in a line

mritenburg
New Member

Hello,

I am trying to craft a regex to match everything between the 25th and 130th character in a line. I am having no success. Someone suggested ^.{25} (?P<FIELDNAME>.{130} but that doesn't work at all. Does anyone know how to create this regex?

Thank you!

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

View solution in original post

rtadams89
Contributor

Depending on what you are trying to accomplish, you may be better off using the eval substr() function. For example:

... | eval newField=substr(field, 26, 104)

Otherwise, you can use this regex to extract the same thing:

^.{25}(?P<newField>.{0,105})
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

mritenburg
New Member

This works perfectly ^.{25}(?P.{1,105}).

Thank you!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...