Splunk Query to extract all the contents/values/characters from the matching String

HomeInfallibleTechie Admin

Splunk Query to extract all the contents/values/characters from the matching String

InfallibleTechie Admin

.* can be used in rex to extract all the contents/values/characters from the matching String.

Syntax:

Your__Base_Splunk_Query
| rex field=field_name "Matching_String: (?<Custom_Field_Name>.*)"

Example:

Your__Base_Splunk_Query
| rex field=info "ExtendedMessage: (?<ExceptionMessage>.*)"

As per the above example, if the info field value is “ExtendedMessage: Test 1 Sample 1 ABC – XYZ”, then ExceptionMessage value will be “Test 1 Sample 1 ABC – XYZ”.

Leave a Reply