Splunk Search

regex to match everything between the 25th and 130th characters in a line

mritenburg
New Member

Hello,

I am trying to craft a regex to match everything between the 25th and 130th character in a line. I am having no success. Someone suggested ^.{25} (?P<FIELDNAME>.{130} but that doesn't work at all. Does anyone know how to create this regex?

Thank you!

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

View solution in original post

rtadams89
Contributor

Depending on what you are trying to accomplish, you may be better off using the eval substr() function. For example:

... | eval newField=substr(field, 26, 104)

Otherwise, you can use this regex to extract the same thing:

^.{25}(?P<newField>.{0,105})
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex you provided will first match characaters 1-25. The capturing group (while incomplete) would then catch the next 130 characters, not upto the 130th character.

Try this: ^.{25}(?P<fieldname>.{1,105}). This should grab everything from 25-130, and will also grab anything that may be less than 130.

mritenburg
New Member

This works perfectly ^.{25}(?P.{1,105}).

Thank you!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...