Splunk Search

rex word extraction?

rakesh_498115
Motivator

How can i write a regular expression to extract string starting with S and ends with 'E'.

I have used like this.

rex "^S(?<LOC>[.]*)E$"

, but not working ??

can you pls help

Tags (1)
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

View solution in original post

arihant16cse
Path Finder

| makeresults | eval aa="asssd sade bvc sfge" | eval bb=split(aa," ") *use this * alt text

0 Karma

nasamajh09
New Member

What if I have to capture somewhere in the middle of the line , not from the begining , how rex can be used here .Please suggest

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

alacercogitatus
SplunkTrust
SplunkTrust

You are most welcome, please mark the answer as accepted if we have answered your question. Thanks!

0 Karma

rakesh_498115
Motivator

Thank you alacercogitatus

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Like This: | rex field=_raw "(?<LOC>S\w*E)"

0 Karma

Ayn
Legend

Just put them inside the matching group instead of outside.

rakesh_498115
Motivator

how can include both S and E as well in the word extraction ??

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...