Splunk Search

How to create Rex for extracting a value from string?


Hello, I am new to splunk rex, need help for below to extract a value from string.

rex "Error while calling database for id = (?<id>.*)"

Example string: "Error while calling database for id =8748723874_1"

Output should be 8748723874


Labels (1)
0 Karma


You didn't show the result or explain why the result is wrong.  Do you mean you just want to get rid of the part after underscore _?  Normally, Splunk should have given you a field id that contains value 8748723874_1.  If so, always work from the smaller data.  You do not need regex for this task.  Just do

| eval id = mvindex(split(id, "_"), 1)

If Splunk doesn't give you this field, you can do

| rex "Error while calling database for id\s*=\s*(?<id>[^_]+)"

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...