How to create Splunk Regex to search for a field after n occurrences of comma?

[atulitm]

I have been trying to create Splunk rex but it doesn't work for some reason and would need help in finding any word or string after n number of commas like

LOG:
12/11/2018, abc, def, ced, xyz

I would like to get variable stored which is after 3 commas which is ced in above case something like :

index= | rex ",{3}(?\w+) | table test 

[FrankVl · Accepted solution]

Your own attempt comes close, but you of course also need to include the strings before / in between those 3 commas in the regex for it to match.

So:

index= | rex "(?:[^,]*,\s*){3}(?<test>\w+)" | table test

Which defines a non capturing group consisting of some arbitrary number of non-comma characters, followed by a comma and possible whitespace. And that group is repeated 3 times. After that, the actual capturing group to capture the string you need.
https://regex101.com/r/AUhB3o/1

[atulitm]

Thanks that helps .. I have tried a lot but may be its simple for you . i would like capture anything after 3rd comma and before 4th because this query helps in getting after 3rd but string after that is having gaps so it doesnt save whole string .

[FrankVl]

Just replace the \w with [^,] and perhaps you need to do something about not capturing the whitespace before the 4th comma. So try this:

index= | rex "(?:[^,]*,\s*){3}(?<test>[^,]+)\s+," | table test

https://regex101.com/r/AUhB3o/2

[atulitm]

Thanks for help frank . I need to improve myself on regex .

[FrankVl]

You're welcome 🙂

And yes, that is a very valuable skill to develop as a Splunk user/admin 🙂

[ctaf]

Hi,

You can do this:

| rex (\s,\s\w+){2}\s,\s(?<fieldname>[^\s]+)

Put {n-1} for n commas. Here it is {2} for 3 commas.

[493669]

try this:

index=indexname|rex ".*,(?<test>\w+)"