find string between two given strings in splunk

Question

How i can get the string between two given strings.

Log has entires like

22:09: DT : 2178we352njsdfh48734 : EF and so on.

I want to find fetch the values between "DT :" and ": EF". The "2178we352njsdfh48734" will vary based on the request and the "DT :" and ": EF": will remain same for all the request.

Answer 1

Generally, you want to either use rex or create a dedicated field extraction. For more complete information, look here.

Using rex:

In the search string, add the following to your search:

| rex field=xx "^\d+:\d+: DT : (?<txid>.*?) : EF"

For something more permanent, you can use:

transforms.conf:

[mytxid]
REGEX = "^\d+:\d+: DT : (.*?) : EF"
FORMAT = txid::$1

props.conf:

[yoursourcetype]
REPORT-txid = mytxid

find string between two given strings in splunk

Follow this question

Splunk Resources

Related questions