Splunk Search

How to create Splunk Regex to search for a field after n occurrences of comma?

atulitm
Path Finder

I have been trying to create Splunk rex but it doesn't work for some reason and would need help in finding any word or string after n number of commas like

LOG:
12/11/2018, abc, def, ced, xyz

I would like to get variable stored which is after 3 commas which is ced in above case something like :

index= | rex ",{3}(?\w+) | table test 
Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Your own attempt comes close, but you of course also need to include the strings before / in between those 3 commas in the regex for it to match.

So:

index= | rex "(?:[^,]*,\s*){3}(?<test>\w+)" | table test

Which defines a non capturing group consisting of some arbitrary number of non-comma characters, followed by a comma and possible whitespace. And that group is repeated 3 times. After that, the actual capturing group to capture the string you need.
https://regex101.com/r/AUhB3o/1

View solution in original post

0 Karma

FrankVl
Ultra Champion

Your own attempt comes close, but you of course also need to include the strings before / in between those 3 commas in the regex for it to match.

So:

index= | rex "(?:[^,]*,\s*){3}(?<test>\w+)" | table test

Which defines a non capturing group consisting of some arbitrary number of non-comma characters, followed by a comma and possible whitespace. And that group is repeated 3 times. After that, the actual capturing group to capture the string you need.
https://regex101.com/r/AUhB3o/1

0 Karma

atulitm
Path Finder

Thanks that helps .. I have tried a lot but may be its simple for you . i would like capture anything after 3rd comma and before 4th because this query helps in getting after 3rd but string after that is having gaps so it doesnt save whole string .

0 Karma

FrankVl
Ultra Champion

Just replace the \w with [^,] and perhaps you need to do something about not capturing the whitespace before the 4th comma. So try this:

index= | rex "(?:[^,]*,\s*){3}(?<test>[^,]+)\s+," | table test

https://regex101.com/r/AUhB3o/2

0 Karma

atulitm
Path Finder

Thanks for help frank . I need to improve myself on regex .

0 Karma

FrankVl
Ultra Champion

You're welcome 🙂

And yes, that is a very valuable skill to develop as a Splunk user/admin 🙂

0 Karma

ctaf
Contributor

Hi,

You can do this:

| rex (\s,\s\w+){2}\s,\s(?<fieldname>[^\s]+)

Put {n-1} for n commas. Here it is {2} for 3 commas.

0 Karma

493669
Super Champion

try this:

index=indexname|rex ".*,(?<test>\w+)"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...