Splunk Search

Rex to Extract Specific Word

IRHM73
Motivator

Hi, I wonder whether someone maybe able to help me please.

I'm using the following rex to extract the word ID from a text string, which can be written in many permutations, e.g. ID, Id, id.

| rex field=text "/^|[^a-zA-Z](?<a>(?i)id)[^a-zA-Z]|$"

Could someone tell me please, is there a simpler way to write this?

Many thanks and kind regards

Chris

Tags (2)
0 Karma
1 Solution

493669
Super Champion

Thanks for sample data.

 | rex field=text "\b(?i)(?id)\b"

here \b matches any position that lies at boundary of word "id"
(?i) --> case insensitive match

View solution in original post

0 Karma

micahkemp
Champion

| rex field=text (?<!\w)(?i)(?<a>id)(?!\w)

That looks for the term id not surrounded by other word characters.

0 Karma

493669
Super Champion

Thanks for sample data.

 | rex field=text "\b(?i)(?id)\b"

here \b matches any position that lies at boundary of word "id"
(?i) --> case insensitive match

0 Karma

IRHM73
Motivator

Hi @493669, as per the solution from @wenthold, this works great and thank you for the explanation.

If you change this to an answer I can accept it.

Kind Regards

Chris

0 Karma

wenthold
Communicator

Try

| rex field=text "\b(?i)(?<a>id)\b"
0 Karma

IRHM73
Motivator

Hi @wenthold, this works great, thank you very much for taking the time to put this together.

Many thanks and kind regards

Chris

0 Karma

niketn
Legend

Can you add some sample data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

493669
Super Champion
 | rex field=text "\s(?i)(?<a>id)\s"

it will match word ID(case insensitive) from a text string

0 Karma

IRHM73
Motivator

Hi @493669, thank you for this.

It certainly extracts the correct words in the different formats, but unfortunately if there is a succeeding special character such a s a . or ) it doesn't extract the word.

Many thanks and kind regards

Chris

0 Karma

493669
Super Champion

Can you try below

| rex field=text "\s(?i)(?<a>id)."
0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

I'm sorry this has a similar issue in that it extracts id from the word "identity".

Many thanks and kind regards

Chris

0 Karma

IRHM73
Motivator

If it helps, here is sample data where id should not be extracted:

The first part of registration was
straight forward but I have been left
confused as to if the process was
completed or not ? when I tried to
continue the system did not recognise
my identity ?

Regards

Chris

0 Karma

DalJeanis
Legend

This will place any single combination of ( ID, iD, Id, or id) that is found in field text into field a, if that is what you want.

 | rex field=text "(?i)(?<a>id)"
0 Karma

IRHM73
Motivator

Hi, thank you for this @DalJeanis, but unfortunately it doesn't quite work because it extracts the id from words such as "said".

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...