All Apps and Add-ons

can i select field between brackets [ XYZ - ABC - ] using regular expression?

royimad
Builder

I need to select fields from a log who are between two [ ]
Event 1: Some data... [ AAA ]
Event 2: Some data... [aa - DD ]

I need those fields
AAA
aa - DD
DD

How to do that? I'm using this regular expression (?P[^ ]+) but the extraction is incorrect it extract

[AAA

[aa
and this is wrong i don't need the first character [ and need to get all the data between [ ]

0 Karma
1 Solution

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

View solution in original post

aholzer
Motivator

Once you figure out your starting point, you can use (?P[^\]]+)

You can do something like

   \[(?P<fieldname>[^\]]+)\]

This way you will pick up everything between an open bracket ([) and a close bracket (]) as long as it's not a close bracket.

Notice that I have escaped the open bracket and two of my close bracket. This makes the regex use the escaped brackets as a character instead of trying to parse them as part of the regex.

Hope this helps

jonuwz
Influencer

Converted to answer - this is correct, and well explained : )

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...