Splunk Search

regular expression to extract lines of text between two different texts

satya671
Explorer

suppose i had data like below field="_raw"

afadfadfadf

afadsfagafg

adfafafa

string1 .........

afjal;dkfhao ilhaf

ajkf;haldghag;lakg

akuhfajkdhfalkfha;

auhaghkajdgakg

jkalfagafg

string2.........

afdasdgadfas

**bleep**adgafgafgaf

agfgertfergreg

And i want to extract the data in between string1 and string2

 

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @satya671 

| makeresults 
| eval _raw="afadfadfadf
afadsfagafg

adfafafa

string1 .........

afjal;dkfhao ilhaf

ajkf;haldghag;lakg

akuhfajkdhfalkfha;

auhaghkajdgakg

jkalfagafg

string2.........

afdasdgadfas" 
| rex "string1(?<extracted>(.|\n)*?)string2" 
| table extracted

 

You could try this.

 

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @satya671 

| makeresults 
| eval _raw="afadfadfadf
afadsfagafg

adfafafa

string1 .........

afjal;dkfhao ilhaf

ajkf;haldghag;lakg

akuhfajkdhfalkfha;

auhaghkajdgakg

jkalfagafg

string2.........

afdasdgadfas" 
| rex "string1(?<extracted>(.|\n)*?)string2" 
| table extracted

 

You could try this.

 

satya671
Explorer

Thanks @venkatasri  it's working as expected 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...