cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
ss394546910
Engager
Member since: ‎07-29-2021
‎10-09-2022
Community Statistics
Posts 3
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎07-29-2021
Activity Feed
View All

Re: How do I use regex to select a string between ...

by in Splunk Search
‎10-07-2022 02:38 PM
‎10-07-2022 02:38 PM
Yes..seems like I am looking for rex not regex. Thanks for helping. ... View more

How do I use regex to select a string between two ...

by in Splunk Search
‎10-07-2022 01:28 PM
‎10-07-2022 01:28 PM
Splunk logs looks like below: userid=234user|rwe23|dwdwd -- userid=id123|34lod|2323 textHow can I get value between "=" and first "|" I want to get table of value between "=" and first "|", like "234user" and "id123" I tried: index=indexhere "userid=" |regex "(?<==)(?<info>.+?)(?=\|)" | dedup info | table info this one works fine in regex101, but shows 0 result in Splunk. Could anyone please help? Any help would be appreciated. Thanks! ... View more
Labels

Splunk search with regex

by in Splunk Search
‎07-29-2021 08:37 PM
‎07-29-2021 08:37 PM
Hi everyone, I got lots of the blow _row after the search: ........ 2002-02-22 17:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000 2002-02-22 13:32:15.592 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103294384.0000 2002-02-22 13:30:15.222 somedatainformation ==> ASH.cctv.mary.CREDITCHECK.103292222.0002 ...... how can I just get the string after the "==>" like "ASH.cctv.mary.CREDITCHECK.103294384.0000" and remove the duplicated value? Thanks ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-09-2022 04:09 AM
Karma given to