Splunk Search

How to extract a field between two patterns in a search

siddharthmis
Explorer

Hi,

How do I get "7515-36283" between "Result:" and "/ Value" from following text:

Result: 75153-6283 / Value

"Result: 75153-6283 / Value" occurs multiple times with different numeric value and might have special character.

I've tried:

... | rex field=_raw "Result: (?P<Order>[^\s]+) / Value" | table Order

It works but does not show all values in a single field. It only shows the first occurrence of the "Order"

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try this one?

 ... | rex max_match=0 field=_raw "Result: (?P<Order>[^\s]+) / Value" | table Order

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try this one?

 ... | rex max_match=0 field=_raw "Result: (?P<Order>[^\s]+) / Value" | table Order

Thanks

0 Karma

siddharthmis
Explorer

This worked, Super thanks

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...