Splunk Search

rex word extraction?

Motivator

How can i write a regular expression to extract string starting with S and ends with 'E'.

I have used like this.

rex "^S(?<LOC>[.]*)E$"

, but not working ??

can you pls help

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

View solution in original post

Path Finder

| makeresults | eval aa="asssd sade bvc sfge" | eval bb=split(aa," ") *use this * alt text

0 Karma

New Member

What if I have to capture somewhere in the middle of the line , not from the begining , how rex can be used here .Please suggest

0 Karma

SplunkTrust
SplunkTrust

Your carrot indicates that you want to capture from the beginning of the line. You want to search within the text so try:

| rex field=_raw "S(?<LOC>\w*)E"

View solution in original post

SplunkTrust
SplunkTrust

You are most welcome, please mark the answer as accepted if we have answered your question. Thanks!

0 Karma

Motivator

Thank you alacercogitatus

0 Karma

SplunkTrust
SplunkTrust

Like This: | rex field=_raw "(?<LOC>S\w*E)"

0 Karma

Legend

Just put them inside the matching group instead of outside.

Motivator

how can include both S and E as well in the word extraction ??

0 Karma