Splunk Search

rex word extraction?

rakesh_498115
Motivator

How can i write a regular expression to extract string starting with S and ends with 'E'.

I have used like this.

rex "^S(?<LOC>[.]*)E$"

, but not working ??

can you pls help

Tags (1)
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

View solution in original post

arihant16cse
Path Finder

| makeresults | eval aa="asssd sade bvc sfge" | eval bb=split(aa," ") *use this * alt text

0 Karma

nasamajh09
New Member

What if I have to capture somewhere in the middle of the line , not from the begining , how rex can be used here .Please suggest

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

alacercogitatus
SplunkTrust
SplunkTrust

You are most welcome, please mark the answer as accepted if we have answered your question. Thanks!

0 Karma

rakesh_498115
Motivator

Thank you alacercogitatus

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Like This: | rex field=_raw "(?<LOC>S\w*E)"

0 Karma

Ayn
Legend

Just put them inside the matching group instead of outside.

rakesh_498115
Motivator

how can include both S and E as well in the word extraction ??

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...