Splunk Search

extract text using regex

moayadalghamdi
Path Finder

hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables:

 

Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule

 

i want to perform a regex to extracted the first word out of each variable so the output would be:

 

risk

endpoint

network

 

 

 

 

thanks ^_^

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

View solution in original post

moayadalghamdi
Path Finder

thanks for the answer ^_^

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @moayadalghamdi,

please try this regex

| rex "^(?<your_field>\w+)"

that you can test at https://regex101.com/r/vKZmWL/1

Ciao.

Giuseppe

moayadalghamdi
Path Finder

you're really a legend, thanks mate splunker ^_^

0 Karma

isoutamo
SplunkTrust
SplunkTrust

And as you want those with lower cases then add this

| makeresults
| eval _raw ="Risk - 24 Hour Risk Threshold Exceeded - Rule
Endpoint - machine with possible malware - fffff
Network - Possible SQL injection - Rule"
| multikv noheader=t 
``` Above create test data ```
| rex "^(?<result>\w+)"
| eval res = lower(result)
| table res result _raw

r. Ismo 

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...