Splunk Search

rex stop after first match

poisar
Explorer

i have a field with several strings like

fieldname = AT-field2-field3

fieldname = DE-field2

fieldname = DE-field2-field3-field4

etc...

 

I try to get a rex to just get the country code:

|rex field=fieldname "^(?<country>.*)-.*"

 

but the result is not just the  Country Code

 

any ideas?

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The .* operator is greedy so it will grab as many characters as it can that still match the expression.  One solution is to use the non-greedy quantifier.

|rex field=fieldname "^(?<country>.*?)-.*"

Another solution is to take everything up to the first hyphen.  Like this:

| rex field=fieldname "^(?<country>[^-]+)-"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The .* operator is greedy so it will grab as many characters as it can that still match the expression.  One solution is to use the non-greedy quantifier.

|rex field=fieldname "^(?<country>.*?)-.*"

Another solution is to take everything up to the first hyphen.  Like this:

| rex field=fieldname "^(?<country>[^-]+)-"

 

---
If this reply helps you, Karma would be appreciated.

poisar
Explorer

thank you for your input. Both variants work and i learned something new 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...